Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Up to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the UrlGenerator component validates route parameters against a pattern constructed as ^ plus the raw requirement plus $. Due to the use of ungrouped alternations, the middle alternatives match as unanchored substrings, allowing a value such as //evil.com to satisfy a common locale requirement and produce a protocol‑relative off‑site URL. This flaw permits attackers to inject protocol‑relative URLs that redirect users to external sites, effectively creating an off‑site URL injection vulnerability. The issue is an input validation weakness (CWE‑185, CWE‑601).

The issue affects the Symfony framework distributed by the symfony vendor. Versions earlier than 5.4.52, 6.4.40, 7.4.12, and 8.0.12 are vulnerable; all newer releases contain the fix.

The CVSS score is 2.3 and the EPSS score is below 1%; the vulnerability is not listed in KEV. Because the flaw requires an attacker to craft a URL that targets a routing component, the likelihood of exploitation is low under current conditions. If exploitation were achieved, the attacker could inject an external link that appears to originate from the application, potentially misleading users or delivering malware. The low CVSS and EPSS suggest a low‑risk scenario, but the presence of an open redirect path merits cautious monitoring.