CVE-2026-122053— Symfony ObjectNormalizer 忽略属性路径遍历漏洞
一分钟漏洞结论
影响对象
sensiolabs symfony
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Symfony Serializer 组件中的 ObjectNormalizer 会将任何包含点号（ ）的属性名（在 Symfony 6.4 及更高版本中，还包含左方括号 ）视为可写的属性路径。这使得不受信任的输入能够修改嵌套对象的属性，并绕过其 元数据属性。此漏洞影响以下 Symfony 版本：5.4.41 至 5.4.56（不含）、6.4.9 至 6.4.50（不含）、7.0.9 至 7.1.0（不含）、7.1.2 至 7.4.23（不含），以及 8.x 系列至 8.1.11（不含）。 具体而言， 方法会接受此
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-122053 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects
来源: CVE Program / CVE List V5
Vulnerability Description
The Symfony Serializer component ObjectNormalizer treats any attribute name containing . (and, from Symfony 6.4, [) as a writable property path, allowing untrusted input to modify properties of nested objects and bypass their #[Ignore] metadata attribute in Symfony versions 5.4.41 prior to 5.4.56, 6.4.9 prior to 6.4.50, 7.0.9 prior to 7.1.0, 7.1.2 prior to 7.4.23, and 8.x prior to 8.1.11.
ObjectNormalizer::isAllowedAttribute() accepts such names, and setAttributeValue() hands the name straight to PropertyAccessor::setValue(), which parses it as a property path and traverses into the nested object. A payload key such as customer.admin writes to $order->customer->admin. The #[Ignore] metadata attribute is only consulted when the nested object is denormalized in its own right, never when it is reached through a path. #[Groups] restrictions are not bypassed: the path is only accepted when no groups are passed in the context, and then groups restrict nothing. When the root class carries neither #[Ignore] nor #[Groups], no allowlist applies and every key of the payload is let through. Because PropertyAccessor also resolves a path segment against public methods, a segment matching a public method name invokes that method with the attacker’s value.Applications that bind untrusted input to objects are affected, including controllers using #[MapRequestPayload] or #[MapQueryString], whose default normalizer is ObjectNormalizer. With OBJECT_TO_POPULATE, as used for partial updates, the traversal reaches an already hydrated entity graph, and the modified field may be persisted.
The fix accepts a property path only when the class metadata declares an attribute of that exact name. Declared paths keep working unchanged, and a path in the payload with no matching declaration is ignored.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
CWE-915
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| sensiolabs | symfony | 5.4.41 ~ 5.4.56 | - |
|
二、漏洞 CVE-2026-122053 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-122053 的情报信息
请登录查看更多情报信息。
CVE-2026-122053 其他参考 (3)
-
https://github.com/symfony/symfony/security/advisories/GHSA-hqp2-7rr8-hf26 third-party-advisory
同批安全公告 · sensiolabs · 2026-11-06 · 共 7 条
| CVE-2026-123792 | 8.7 HIGH | Symfony YAML 解析器拒绝服务漏洞 |
| CVE-2026-118515 | 8.4 HIGH | Symfony 任意文件上传漏洞 |
| CVE-2026-121623 | 8.2 HIGH | Symfony DataUriNormalizer 任意文件读取漏洞 |
| CVE-2026-123746 | 2.3 LOW | Symfony 认证绕过漏洞 |
| CVE-2026-123339 | 2.3 LOW | Symfony 4.4.40 远程请求伪造漏洞 |
| CVE-2026-123824 | 2.3 LOW | Symfony Config XmlUtils 配置 XML 外部实体注入漏洞 |