---
id: "CVE-2026-122053"
page: "https://infrastack.ai/live/CVE-2026-122053"
kind: "vulnerability"
aliases: ["CVE-2026-122053"]
title: "Symfony: Serializer normalizer lets requests write nested object properties"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "symfony", "symfony-controller", "symfony-serializer"]
not_affected_if: ["custom-normalizer", "no-untrusted-object-binding"]
published_at: "2026-11-06T17:17:20+00:00"
first_seen_at: "2026-11-06T17:43:12+00:00"
updated_at: "2026-11-06T17:45:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122053", "first_seen_at": "2026-11-06T17:43:12+00:00"}]
exploit_sources: []
---

# Symfony: Serializer normalizer lets requests write nested object properties

Link for people: https://infrastack.ai/live/CVE-2026-122053 (this .md is for agents)

Symfony's Serializer ObjectNormalizer accepts attribute names containing dots or brackets and treats them as property paths. An attacker can send a payload key such as customer.admin to write into nested objects, bypass their #[Ignore] attributes, or invoke public methods.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `symfony/serializer` version in `composer.lock` or with `composer show symfony/serializer`.
- Look for controllers or code that deserialize untrusted input into objects with `ObjectNormalizer`, including `#[MapRequestPayload]` and `#[MapQueryString]`, and for `OBJECT_TO_POPULATE` used on partial updates.

## Fix

- Upgrade `symfony/serializer` to `5.4.56` or later on the 5.4 line.
- Upgrade to `6.4.50` or later on the 6.4 line.
- Upgrade to `7.1.0` or later on the 7.0 line, or `7.4.23` or later on the 7.1 and 7.4 lines.
- Upgrade to `8.1.11` or later on the 8.x line.

## Timeline

- 2026-11-06T17:43:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122053

## Documents

- [advisory] Vendor advisory: github.com https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26
- [fix] Patch: github.com https://github.com/symfony/symfony/commit/9f7390678a255f7962fb1c81c42b26fa907d3437
- [fix] Patch: github.com https://github.com/symfony/symfony/commit/fcaf87a93c7fa5b7fe9e9e8382d4ed0d0c52c67c

## From the sources

The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.
ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.

The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_