p PatchFirst

GHSA-7cvr-xhm5-x998

GHSA-7cvr-xhm5-x998 · Twig Path Traversal vulnerability in the filesystem loader

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance). When affected, it is possible to go up one directory for the paths configured in the application's loader. For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %} Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.

CVSS 5.3 · Medium · Fix available

Published
Updated

Stack: php

Affected products and versions

  • twig/twig Packagist

    Versions
    • 1.3.0
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.6.5
    • v1.10.0
    • v1.10.1
    • v1.10.2
    • v1.10.3
    • v1.11.0
    • v1.11.1
    • v1.12.0
    • v1.12.0-RC1
    • v1.12.1
    • v1.12.2
    • v1.7.0
    • v1.8.0
    • v1.8.1
    • v1.8.2
    • v1.8.3
    • v1.9.0
    • v1.9.1
    • v1.9.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.12.3

    Update to 1.12.3

Original sources

Check your server →