GHSA-7cvr-xhm5-x998

GHSA-7cvr-xhm5-x998 · Twig Path Traversal vulnerability in the filesystem loader

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance). When affected, it is possible to go up one directory for the paths configured in the application's loader. For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %} Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.

CVSS 5.3 · Media · Corrección disponible

Publicación

2024-05-30T13:42:49Z

Actualización

2024-12-05T05:41:41.920078Z

Pila tecnológica: php

Comprueba tu servidor →