~ / search / GHSA-52m2-vc4m-jj33

GHSA-52m2-vc4m-jj33

Twig may load a template outside a configured directory when using the filesystem loader

Source: GitHub Advisory Database (reviewed) High CVE-2022-39261

Packages

EcosystemPackageAffectedFixed in
Packagist twig/twig >= 1.0.0, < 1.44.7 1.44.7
Packagist twig/twig >= 2.0.0, < 2.15.3 2.15.3
Packagist twig/twig >= 3.0.0, < 3.4.3 3.4.3

Details

As written in the advisory (Markdown source, shown as plain text).

# Description When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed). # Resolution We fixed validation for such template names. Even if the 1.x branch is not maintained anymore, a new version has been released. # Credits We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

References

External links from the advisory. They lead to third-party sites.