The Symfony Serializer’s ObjectNormalizer treats attribute names that include a dot (.) or, from Symfony 6.4, an opening bracket ([) as a property path. When an attacker supplies a key such as customer.admin, the normalizer resolves the path and writes to $order->customer->admin, effectively modifying nested object properties that are normally protected by the #[Ignore] attribute. Because PropertyAccessor also interprets a path segment as a public method name, an attacker can trigger public methods with arbitrary values, allowing unintended writes to private or protected state and potentially executing sensitive functionality. The weakness is identified by CWE‑915, which concerns property‑path traversal leading to unauthorized property modification.

Applications built with SensioLabs Symfony are affected. Versions 5.4.41 through 5.4.55, 6.4.9 through 6.4.49, 7.0.9 through 7.0.99, 7.1.2 through 7.4.22, and all 8.x releases below 8.1.11 are vulnerable. The flaw manifests in any endpoint that binds untrusted input to objects via the default ObjectNormalizer, such as controllers using #[MapRequestPayload] or #[MapQueryString], or when OBJECT_TO_POPULATE is used for partial updates.

The CVSS score of 6.9 denotes moderate severity. The EPSS score is not available, so the probability of exploitation cannot be accurately quantified. The vulnerability is not listed in the CISA KEV catalog. The exploit is likely to occur remotely by submitting crafted payloads to endpoints that deserialize untrusted input, allowing attackers to tamper with nested data, bypass isolation attributes, or invoke arbitrary public methods when the application logic is driven by user input.