CVE-2026-54164— API Platform Core 缓冲区错误漏洞

API Platform Core: Missing IRI type check enables resource type confusion

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended type can be silently assigned to a relation property. An attacker who can submit write requests (POST/PUT/PATCH) to an API Platform endpoint with writable relations can supply a relation IRI pointing to a resource of a different type than the relation's declared class. Because getResourceFromIri() does not pass an $operation to IriConverter::getResourceFromIri(), the is_a type guard at IriConverter.php:86 is skipped. For untyped relation properties (legacy @var-only style), the wrong-typed object is silently assigned, corrupting invariants and potentially feeding downstream logic that assumes the declared type (CWE-843). For typed properties (modern PHP 8.x), the substitution is blocked by Symfony's PropertyAccessor with an InvalidTypeException. This issue has been fixed in versions 4.1.30, 4.2.26 and 4.3.12.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

使用不兼容类型访问资源(类型混淆)

API Platform Core 缓冲区错误漏洞

API Platform Core是API Platform团队开源的一个 API Platform 的服务器组件。 API Platform Core存在缓冲区错误漏洞，该漏洞源于序列化器的AbstractItemNormalizer在解析关系IRI时未验证返回的资源类型，导致类型混淆，可能使非预期类型的资源被静默赋值给关系属性。攻击者可以通过提交写请求，提供指向不同类型资源的关系IRI，从而绕过类型检查。以下版本受到影响：4.1.30之前版本、4.2.0版本至4.2.26之前版本和4.3.0版本至4.

N/A

N/A