Twig may load a template outside a configured directory when using the filesystem loader
# Description When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed). # Resolution We fixed validation for such template names. Even if the 1.x branch is not maintained anymore, a new version has been released. # Credits We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-39261US | high7.5 | — | ||
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for whi… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yamlWEB
- https://github.com/twigphp/TwigPACKAGE
- https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0bWEB
- https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33WEB
- https://lists.debian.org/debian-lts-announce/2022/10/msg00016.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NRWEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJPWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan