CVE-2026-109413 - Symfony YAML bundled with Zabbix 7.4.16

[Hulky Hulk]

Our Tenable vulnerability scanner has flagged CVE-2026-109413 on a Zabbix 7.4.16 server running Ubuntu 24.04.
The finding relates to:

symfony/yaml
Installed: 5.1.3
Fixed: 5.4.54

I've confirmed that the current zabbix-frontend-php package (1:7.4.16-2+ubuntu24.04) contains symfony/yaml v5.1.3 in:

/usr/share/zabbix/ui/composer.lock

The Symfony YAML component is also present under vendor, and Zabbix appears to actively use it for configuration imports via:

include/classes/import/readers/CYamlImportReader.php

which calls:

Yaml:: parse($string)

Our standard User role does not have configuration.import in its API allow list, whereas administrative roles can access configuration import.
Could Zabbix please confirm:

1. Is Zabbix 7.4.16 considered affected by CVE-2026-109413?
2. Is configuration.import / CYamlImportReader considered an exploitable path?
3. Is an updated 7.4 package with a fixed Symfony YAML version planned?
4. Is restricting configuration.import to trusted administrators the recommended mitigation in the meantime?

I don't want to manually update the bundled Composer dependencies as these are managed by the Zabbix package.
Thanks.