Symfony's UrlSanitizer::parse() method rejects raw bidirectional (BiDi) formatting characters but allows percent‑encoded forms of those characters and performs a whitespace check limited to ASCII characters. As a result, sanitized URLs can still contain percent‑encoded BiDi marks or Unicode whitespace that downstream components may decode or render. The flaw does not provide code execution or privilege escalation; its primary effect is that users may be presented with URLs that visually appear legitimate but lead to deceptive destinations. The weakness is listed as CWE‑1007 (Improper Validation or Handling of Untrusted Input) and CWE‑451 (Wrong Interpretation of Characters).

The affected products are the Symfony Framework core and the html‑sanitizer component. Versions from 6.1.0 through 6.4.40, from 7.0.0 through 7.4.12, and from 8.0.0 through 8.0.12 are impacted. The issue is addressed in the patched releases 6.4.41, 7.4.13, and 8.0.13. These releases are available in the official Symfony releases and security advisories.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation based solely on historical data. The vulnerability is not listed in CISA's KEV catalog. Attackers are likely to craft URLs containing percent‑encoded BiDi marks or Unicode whitespace and embed them in links, emails, or web pages to mislead users. This inference is drawn from the nature of the vulnerability and common use of URL-based social engineering.