CVE-2026-27206: Zumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()

The zumba/json-serializer library allows deserialization of PHP objects from JSON using a special @type field.

Prior to version 3.2.3, the deserializer would instantiate any class specified in the @type field without restriction. When processing untrusted JSON input, this behavior may allow an attacker to instantiate arbitrary classes available in the application.

If a vulnerable application passes attacker-controlled JSON into JsonSerializer::unserialize() and contains classes with dangerous magic methods (such as __wakeup() or __destruct()), this may lead to PHP Object Injection and potentially Remote Code Execution (RCE), depending on available gadget chains in the application or its dependencies.

This behavior is similar in risk profile to PHP’s native unserialize() when used without the allowed_classes restriction.