Classes within Symfony's Routing component, namely CompiledUrlMatcher and UrlMatcher, handle host and path differently. The CompiledUrlMatcher concatenates the host and path before applying regular expressions, whereas UrlMatcher separates them. A host placeholder that can match a forward slash causes parts of the path to be consumed during host matching. As a result, requests that should be blocked by path‑based authorization rules are routed directly to the controller, allowing unauthenticated or unauthorized users to invoke protected actions. This is an intentional access control flaw, catalogued as improper authorization handling and improper access control.

The flaw exists in Symfony versions prior to 5.4.56, 6.4.50, 7.4.23 and 8.1.11 when routes declare host placeholders that are protected by path‑based firewall or access_control rules. Applications built with the sensiolabs Symfony framework that use such routes are susceptible. The default restriction that the Host header matches the host without its leaf label may mitigate the issue if configured, but it is unsafe when the requirement accepts a simple slash or when the web server forwards an absolute URI.

The CVSS score of 6.3 indicates a moderate risk. While there is no EPSS data, attackers who can send crafted HTTP requests can exploit the vulnerability. The attacker can send a request with a Host header that contains a slash in the placeholder part and a path that matches a protected route, thus bypassing access_control entries and reaching the controller directly. The vulnerability is not listed in the CISA KEV catalog, but the potential for unauthorized access makes monitoring or patching advisable.