Symfony’s HtmlSanitizer component permits URLs that are not on the allowlist when the allowLinkHosts() or allowMediaHosts() methods are used. The flaw stems from a discrepancy between the RFC 3986 parser used by the component’s UrlSanitizer::parse() method and the WHATWG URL algorithm that browsers implement, causing certain URLs to be accepted incorrectly. Additionally, <area href> tags are mistakenly validated against the media policy instead of the link policy, allowing further exploitation. This weakness is a type of parsing error (CWE‑184) and mis‑applied policy (CWE‑436). The impact is that an attacker can inject links or media from arbitrary hosts into sanitized user content, potentially facilitating social engineering or other content‑based attacks, but it does not lead to remote code execution.

The vulnerability exists in Symfony framework releases from 6.1.0‑BETA1 up to 6.4.39, 7.4.11 and earlier, and 8.0.11 and earlier, and is fixed starting with versions 6.4.40, 7.4.12, and 8.0.12. The affected component is symfony:html-sanitizer and the framework itself. Update to the mentioned releases to remediate.

The CVSS score for this issue is 2.3 and the EPSS score is less than 1%, indicating a low likelihood of exploitation and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted user input that contains suspicious URLs or <area href> tags to be processed by the application's HtmlSanitizer. The likely attack vector is through any feature that accepts user‑generated content (such as comments, email templates, or other HTML input). This inference is based on the described sanitization flow; no elevated privileges or additional conditions are required beyond providing the crafted input.