UpHeron
All vulnerabilities

Servers and applications

GHSA-hqp2-7rr8-hf26

ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objects

Severity
Medium
Published
4 Nov 2026
Last changed
4 Nov 2026
Added to UpHeron
4 Nov 2026
Fixed in
5.4.56, 6.4.50, 7.1.0, 7.4.23, 8.1.11
Sources
Project advisories (GitHub)

Affected software

SoftwareAffected versions
SymfonyServers and applications · github:symfony/symfony
  • From 5.4.41 before 5.4.56
  • From 6.4.9 before 6.4.50
  • From 7.0.9 before 7.1.0
  • From 7.1.2 before 7.4.23
  • From 8 before 8.1.11

References