AIKIDO-2026-10958
symfony/routing is vulnerable to Deserialization of Untrusted Data
75
High Risk
This Affects:
symfony/routingTL;DR
The Route and CompiledRoute classes deserialize typed string properties from a raw array during __unserialize(). PHP coerces \Stringable objects through __toString() during that assignment, so validation after assignment cannot prevent gadget execution. Crafted serialized payloads can invoke attacker-controlled __toString() logic when an application deserializes untrusted data. Legacy Serializable entry points that called plain unserialize() without class restrictions were also removed. The fix rejects \Stringable values before assignment and drops the legacy deserialization methods.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/routing is vulnerable to Deserialization of Untrusted Data in versions 6.4.0 - 6.4.40, 7.4.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/routing and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant