CVE-2015-7809: High severity twig vulnerability
Remote code execution in templates
Other sources
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template.
— GitHub
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the self variable in a template.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7809?
CVE-2015-7809 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2015-7809?
To fix CVE-2015-7809, upgrade Twig to version 1.20.0 or later.
What is affected by CVE-2015-7809?
CVE-2015-7809 affects versions of the Twig templating engine prior to 1.20.0 when Sandbox mode is enabled.
What impact does CVE-2015-7809 have on applications?
CVE-2015-7809 allows remote attackers to execute arbitrary code within applications that use vulnerable versions of Twig.
Is there a workaround for CVE-2015-7809 if upgrading is not possible?
If upgrading is not possible, consider disabling Sandbox mode to mitigate the risk posed by CVE-2015-7809.