Twig may load a template outside a configured directory when using the filesystem loader (twigphp Twig)
At a glance
- Source
- NVD
- EPSS
- EPSS 3.17 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
Weaknesses (CWE)
- CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
References
- https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33
- https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b
- https://www.drupal.org/sa-core-2022-016
- https://www.debian.org/security/2022/dsa-5248
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/
- https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- DRUPAL-CORE-2022-016 — Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has released a security update](https://sym
- GHSA-52m2-vc4m-jj33 — Twig may load a template outside a configured directory when using the filesystem loader
European references
- ENISA EUVD · EUVD-2022-6700
- GCVE · GCVE-0-2022-39261
CERT-FR advisories
- CERTFR-2022-AVI-866 — Vulnérabilité dans Drupal core · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 1.0.0 < 1.44.7cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.15.3cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*≥ 3.0.0 < 3.4.3cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 8.0.0 < 9.3.22cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*≥ 9.4.0 < 9.4.7cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| twigphp · Twig | affected => 1.0.0, < 1.44.7 ; affected >= 2.0.0, < 2.15.3 ; affected >= 3.0.0, < 3.4.3 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |