The Zumba Json Serializer library provides JSON serialization and deserialization of PHP data. In versions 3.2.2 and earlier, the deserializer accepts an @type field that specifies a PHP class to instantiate. Because this field is processed without any restriction, an attacker can cause the library to create any class that exists in the running application. The resulting object may invoke magic methods such as __wakeup() or __destruct(), which can lead to PHP object injection. If the application or any of its dependencies provide a gadget chain that can be triggered by these methods, remote code execution becomes possible. This weakness corresponds to CWE‑502, the improper handling of serialized data.

The vulnerability affects the Zumba Json Serializer project, specifically all releases up to and including 3.2.2. Users of 3.2.2 or earlier who call JsonSerializer::unserialize() with untrusted or attacker‑controlled JSON are at risk. The fix was released in version 3.2.3, and later releases are not impacted.

The CVSS v3 score of 8.1 indicates high severity, though the EPSS probability is below 1 %, suggesting exploitation is unlikely at present. Nevertheless, any application that accepts arbitrary JSON from external sources and forwards it to JsonSerializer::unserialize() is vulnerable, as the attacker must provide the JSON payload and the target environment must contain exploitable classes. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but it shares the risk profile of native PHP unserialize without allowed_classes safeguards.