[MEDIUM] XML injection via CDATA terminator in XML request serialization

PKSA-39d7-zgf3-b3y1 CVE-2026-53723 GHSA-q8r6-5hfw-5jff

Affected version: <1.5.4

Reported by:
GitHub, FriendsOfPHP/security-advisories