Symfony’s UrlGenerator::doGenerate() performs dot‑segment encoding with an incorrect strtr() routine that skips every other chained '../' or './' segment. As a result, attacker‑controlled route parameters can generate URLs that, after RFC 3986 normalization, collapse to a path that differs from the intended one. This flaw is associated with CWE‑172 (Relative Path Traversal) and CWE‑601 (URL Redirection to Untrusted Site). It does not provide arbitrary code execution.

Symfony’s Routing component and the core framework are affected. Vulnerable versions are prior to 5.4.53 for Symfony 5, prior to 6.4.41 for Symfony 6, prior to 7.4.13 for Symfony 7, and prior to 8.0.13 for Symfony 8. All earlier releases before those patch versions remain vulnerable.

The CVSS score of 5.1 positions this vulnerability in the medium severity range. The EPSS score of less than 1% suggests a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could exploit the flaw by crafting a URL that includes repeated dot‑segments such that UrlGenerator produces a path that resolves to an unintended resource. The likely attack vector is remote via HTTP requests.