GHSA-7cvr-xhm5-x998

GHSA-7cvr-xhm5-x998 · Twig Path Traversal vulnerability in the filesystem loader

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance). When affected, it is possible to go up one directory for the paths configured in the application's loader. For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %} Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.

CVSS 5.3 · Mittel · Korrektur verfügbar

Veröffentlicht

2024-05-30T13:42:49Z

Aktualisiert

2024-12-05T05:41:41.920078Z

Technologie-Stack: php

Prüfen Sie Ihren Server →