The Symfony HtmlSanitizer component interprets URLs using league/uri, which follows RFC 3986, inconsistently with the WHATWG URL standard used by browsers. As a result, URLs that lack a well‑formed authority—such as http:evil.example, ///evil.example, or https://://evil.example/—are parsed without a host by the sanitizer. When a host allow‑list is combined with allowRelativeLinks(true) or allowRelativeMedias(true), this parsing flaw permits untrusted hosts to appear in the sanitized output, potentially enabling the injection of malicious content.

The issue affects Symfony releases 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The affected vendor is SensioLabs. The default configuration is not impacted; only setups that explicitly enable allowRelativeLinks or allowRelativeMedias in combination with a host allow‑list are vulnerable.

The CVSS score of 2.3 classifies this vulnerability as low severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation. Inferred attack scenarios involve an attacker delivering crafted URLs to an application that forwards user input to the HtmlSanitizer with allow‑list logic enabled. Because the flaw does not allow arbitrary code execution, the risk is confined to the inadvertent inclusion of untrusted hosts in the rendered output.