Symfony's UrlSanitizer::parse() method in versions 6.1.0 through 6.4.40, 7.4.12, and 8.0.12 improperly sanitizes URLs by rejecting raw BiDi formatting characters but not percent-encoded equivalents, combined with an ASCII-only whitespace check. This allows sanitized URLs to retain visual-spoofing characters that downstream components might decode or display, potentially leading to visual spoofing attacks. The vulnerability is resolved in Symfony versions 6.4.41, 7.4.13, and 8.0.13. The affected Ubuntu package versions include multiple specific versions across Ubuntu 16.04 LTS through 26.04 LTS and Ubuntu Pro releases, as listed. No known exploits in the wild have been reported.

The vulnerability allows visual-spoofing characters to remain in sanitized URLs, which could mislead users or systems that decode or display these URLs. This could potentially facilitate phishing or other social engineering attacks by making malicious URLs appear benign. There is no indication of direct code execution or data compromise from this issue alone.

A fix is available in Symfony versions 6.4.41, 7.4.13, and 8.0.13. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, manual patching or upgrading is required. No vendor advisory content contradicts this guidance.