CVE-2022-39261: Twig may load a template outside a configured directory when using the filesystem loader
Possibility to load a template outside a configured directory when using the filesystem loader
Other sources
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-39261?
CVE-2022-39261 is a vulnerability that allows the loading of a template outside of a configured directory when using the filesystem loader in Twig.
Which software packages are affected by CVE-2022-39261?
The Twig package versions 1.0.0 to 1.44.7, 2.0.0 to 2.15.3, and 3.0.0 to 3.4.3 are affected by CVE-2022-39261.
What is the severity of CVE-2022-39261?
The severity of CVE-2022-39261 is moderate.
How can I fix CVE-2022-39261?
To fix CVE-2022-39261, upgrade the Twig package to a version higher than 1.44.7, 2.15.3, or 3.4.3.
Where can I find more information about CVE-2022-39261?
You can find more information about CVE-2022-39261 at the following reference link: [https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader](https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader)