Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-27206

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type field without restriction. When processing untrusted JSON input, this behavior may allow an attacker to instantiate arbitrary classes available in the application. If a vulnerable application passes attacker-controlled JSON into JsonSerializ
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5781fb2fb96fe1225552dab89e11aaf1c7b7e0239db34ee38a8ce5ea0ac1fb8c
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"json-serializer","vendor":"zumba","versions":[{"status":"affected","version":"< 3.2.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/zumba/json-serializer/commit/bf26227879adefce75eb9651040d8982be97b881","tags":["x_refsource_MISC"],"url":"https://github.com/zumba/json-serializer/commit/bf26227879adefce75eb9651040d8982be97b881"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/references/1
{"name":"https://github.com/zumba/json-serializer/releases/tag/3.2.3","tags":["x_refsource_MISC"],"url":"https://github.com/zumba/json-serializer/releases/tag/3.2.3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/references/2
{"name":"https://github.com/zumba/json-serializer/security/advisories/GHSA-v7m3-fpcr-h7m2","tags":["x_refsource_CONFIRM"],"url":"https://github.com/zumba/json-serializer/security/advisories/GHSA-v7m3-fpcr-h7m2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2e5cebcc27e717e829f7110c4c0f4f1af81c151443f478931479551e87e54f9a · sha256:e613f57d47da06ca… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer