The vulnerability is a path traversal flaw in Symfony UX’s ux command where a crafted recipe kit containing file paths such as ../../../etc can cause the command to resolve those paths outside the intended directory, allowing attacker-controlled content to be written or local files to be read that are not meant to be exposed. This issue occurs because Path::isRelative() accepts those paths as relative, enabling the copy‑files map in the recipe manifest to perform operations on unintended targets. The result is a potential compromise of confidentiality, integrity, and availability of the underlying system as a classic CWE-22 weakness.

Products affected are Symfony UX versions prior to 2.36.1 (starting at 2.32.0) and prior to 3.2.0 (starting at 3.0.0). The vulnerability is fixed in versions 2.36.1 and 3.2.0.

Based on the description, it is inferred that the likely attack vector is through a malicious or compromised recipe kit supplied to the ux:install command. With a CVSS score of 7.8, the vulnerability is considered high. The EPSS score is <1%, and as the issue is not listed in the CISA KEV catalog the public exploitation likelihood is uncertain. An attacker requires local or privileged access to supply the crafted kit, making the risk notable for environments that automatically install recipe kits.