Symfony UX versions >=2.32.0 <2.36.1 and >=3.0.0 <3.2.0 contain a path traversal vulnerability in the ux:install console command. The command installs files from a recipe kit by copying paths listed in a copy-files map. Because Path::isRelative() incorrectly accepts paths like '../../../etc', an attacker controlling or crafting a recipe kit can cause the command to write or read files outside the intended directory, potentially leading to arbitrary file write or local file disclosure. The vulnerability is addressed in versions 2.36.1 and 3.2.0.

Successful exploitation can lead to arbitrary file write and local file read outside the intended directory, potentially compromising confidentiality, integrity, and availability of the system. The CVSS score is 7.8 (High), indicating significant impact with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Upgrade Symfony UX to version 2.36.1 or later if using the 2.x branch, or to version 3.2.0 or later if using the 3.x branch. These versions contain the official fix for this path traversal vulnerability. No other mitigations are indicated by the vendor advisory.