p PatchFirst

PatchFirst · Latest vulnerabilities

php-twig vulnerabilities · Page 2

Vulnerabilities published for php-twig in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 21

  1. CVE-2022-23614

    High · CVSS 8.8EPSS 8.21%Fix available

    Code injection in Twig

    Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

    php-twigOperating systems
    • Update to 3.3.8-1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →