Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

zumba/json-serializer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1PackagistPublished

    Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

    CVE-2026-27206 · GHSA-v7m3-fpcr-h7m2

    Affected
    • Packagist zumba/json-serializer < 3.2.3
    Fixed in
    3.2.3· Vendor fix available
    Issue
    The zumba/json-serializer library allows deserialization of PHP objects from JSON using a special @type field. Prior to version 3.2.3, the deserializer would instantiate any class specified in the @type field without restriction. When processing untrusted JSON input, this behavior may allow an attacker to instantiate arbitrary classes available in the application. If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as wakeup() or destruct()), this may lead to PHP Object Injection and potentially Remote Code Execution (RCE), depending on available gadget chains in the application or its dependencies. This behavior is similar in risk profile to PHP's native unserialize() when used without the allowedclasses restriction. Impact This vulnerability allows instantiation of arbitrary PHP classes via the @type field when deserializing JSON. Applications are impacted only if:…

    Recommended action: Upgrade to 3.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →