The validator component internally uses PHP filter flags to classify IP addresses as public or private. These flags omit certain address ranges, notably shared 100.64/10 space and IPv4‑mapped or compatible IPv6 forms, which can encapsulate private IPv4 addresses. As a result, addresses such as ::ffff:127.0.0.1 are incorrectly accepted as public by the Ip constraint, allowing an attacker to supply a seemingly public address that actually resolves to an internal host and cause the application to make a server‑side request. This flaw is a classic server‑side request forgery scenario, potentially exposing internal resources.

The issue is present in the Symfony framework, specifically the Validator component. Affected releases include Symfony 5.x before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11. The product is identified as Symfony by the vendor SensioLabs and is represented in the CPE namespace cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*.*.

The vulnerability carries a CVSS score of 6.3, indicating moderate severity. EPSS scoring is not provided, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by supplying malicious input that is validated as a public IP yet resolves to an internal system, provided that the application uses the Ip constraint without additional safeguards. The direct impact is unauthorized access to internal services via SSRF, which can lead to data exfiltration, privilege escalation, or further network compromise.