EUVD-2026-41126
GHSA-9rjg-x2p2-h68h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible API write endpoint requires low-privilege authenticated access (PR:L); integrity is high from silent type-confused data corruption; no confidentiality or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation's declared class. Because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), the is_a type guard at IriConverter.php:86 is skipped. For untyped relation properties (legacy @var-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony's PropertyAccessor with an InvalidTypeException. This issue has been fixed in versions 4.1.30, 4.2.26 and 4.3.12.
AnalysisAI
Type confusion in API Platform Core's AbstractItemNormalizer allows authenticated API consumers to corrupt relational data by supplying IRIs pointing to resources of the wrong type during write operations (POST/PUT/PATCH). The root cause is that getResourceFromIri() omits the $operation context when calling IriConverter::getResourceFromIri(), silently bypassing the is_a type guard at IriConverter.php:86. All 4.1.x, 4.2.x, and 4.3.x releases prior to the patched versions are affected; no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
API Platform Core is a PHP framework for building Hydra/JSON-LD hypermedia REST and GraphQL APIs. The vulnerability resides in the serialization layer's AbstractItemNormalizer, which resolves incoming relation IRIs (resource URLs) into PHP objects during deserialization of write payloads. The normalizer calls getResourceFromIri() without forwarding the $operation parameter, which causes IriConverter to skip the is_a class-type guard at IriConverter.php:86 that would otherwise reject a resource whose class does not match the relation's declared type. CWE-843 (Access of Resource Using Incompatible Type) is the root cause class. The exploitability varies by PHP property style: legacy untyped @var-annotated relation properties silently accept the wrong-typed object, directly corrupting application invariants; modern PHP 8.x strictly typed properties trigger an InvalidTypeException from Symfony's PropertyAccessor, providing a partial natural mitigation. Affected CPE: cpe:2.3:a:api-platform:core:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to API Platform Core 4.1.30, 4.2.26, or 4.3.12, which restore type validation in AbstractItemNormalizer by correctly passing the $operation context to IriConverter::getResourceFromIri(), re-enabling the is_a type guard. The vendor advisory is at https://github.com/api-platform/core/security/advisories/GHSA-9rjg-x2p2-h68h. If an immediate upgrade is not feasible, restrict write access (POST/PUT/PATCH) on endpoints with writable relation properties to fully trusted, higher-privilege roles only, reducing exposure to least-privileged users who could exploit the bypass. Applications already using PHP 8.x typed relation properties benefit from partial mitigation via Symfony's PropertyAccessor raising an InvalidTypeException on type mismatch - but this is not a complete fix, as it depends on per-property typing discipline across the codebase and does not prevent exploitation on any untyped properties. Auditing the data model for untyped @var-only relation properties and converting them to PHP 8.x typed declarations provides an additional compensating control with the trade-off of requiring a PHP version and code refactor.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today