Package · Packagist

zumba/json-serializer

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

High 8.1

CVE-2026-27206

Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

Zumba Json Serializer is a library to serialize PHP variables in JSON format. In versions 3.2.2 and below, the library allows deserialization of PHP objects from JSON using a special @type field. The deserializer instantiates any class specified in the @type …

zumba json-serializer php-zumba-json-serializer zumba/json-serializer Debian Ubuntu Packagist

Feb 21, 2026