Meta tags using the http-equiv="refresh" attribute are now subject to a sanitization bypass because the regular expression in Symfony's MetaRefreshAttributeSanitizer is too narrow. This allows an attacker to embed a URL that escapes the framework's UrlSanitizer and bypasses both allowLinkSchemes and allowLinkHosts, resulting in an unexpected redirection to an untrusted site. The weakness is a form of open redirect that can occur in any configuration that permits meta tags, including the documented allowStaticElements() preset.

Vendors affected are SensioLabs' Symfony framework. All releases in the 6.1.x line before 6.4.50, the 7.x line before 7.4.23, and the 8.x line before 8.1.11 are vulnerable. The fix is incorporated in Symfony 6.4.50 and later, 7.4.23 and later, and 8.1.11 and later version releases.

The CVSS score of 5.3 indicates a moderate severity, and the vulnerability is client‑side, meaning it can be triggered simply by serving crafted HTML content that contains a malicious refresh directive. Because the attack does not rely on server‑side configuration beyond enabling meta tags, the potential for exploitation is broad and could be used to conduct phishing or drive users to malicious sites. While EPSS data is unavailable, the fact that this is not recorded in CISA's KEV catalog suggests that there is no widespread exploitation yet, but the risk remains for organizations that host content permitting meta refresh tags.