Symfony's Mime component validates and encodes the values of MIME header parameters but emits parameter names verbatim. If an attacker can influence a parameter name that is derived from untrusted input, they can inject CRLF or other non‑token characters. This allows the crafting of additional email headers in structured fields such as Content‑Type or Content‑Disposition. The flaw is categorized as CWE‑93 and can lead to arbitrary header manipulation in outbound mail, potentially bypassing security filters or altering the perceived origin of a message. The vulnerability exists only in Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, and has been fixed in those releases.

Symfony applications that use the Symfony Mime component or the core framework and run any of the following versions are affected: Symfony 5.4.x prior to 5.4.52, Symfony 6.4.x prior to 6.4.40, Symfony 7.4.x prior to 7.4.12, and Symfony 8.0.x prior to 8.0.12. Any deployment that constructs MIME headers with a parameter name derived from user‑supplied data falls under this vulnerability.

The CVSS score of 6.3 indicates moderate severity. The EPSS score of less than 1% reflects a very low probability of real‑world exploitation at present, and the issue is not listed in CISA's KEV catalog. The likely attack vector involves an attacker controlling data that is incorporated into a MIME header parameter name. Since the vulnerability requires the attacker to supply such data, exploitation would occur when a malicious user provides a specially crafted parameter name, resulting in additional headers being injected into the email sent by the application. No publicly available exploits or proof‑of‑concepts have been reported.