CVE-2026-59191: TwigView: FileLoader is vulnerable to arbitrary file read

Q: Which deployments are exposed?

Deployments using composer/jasny/twig-view before version 1.3.3 or 2.1.2 are affected only where unvalidated user-controlled input can be supplied to FileLoader::findTemplate().

Q: What does an attacker need to exploit this issue?

An attacker needs a path by which they can control data passed to FileLoader::findTemplate() without validation. No authentication or user interaction is required according to the supplied severity vector.

Q: Are default installations affected?

The issue is conditional rather than inherent to every use of the plugin: exploitation depends on whether the application passes unvalidated user-controlled data to FileLoader::findTemplate().

Q: What should be done if patching cannot happen immediately?

Ensure that input reaching FileLoader::findTemplate() is not user controlled, or strictly validate it before use. Upgrade to version 1.3.3 or 2.1.2 when possible.

Q: How can I determine whether my application is already at risk?

Check the installed composer/jasny/twig-view version and review calls to FileLoader::findTemplate() for values derived from requests or other user-controlled sources without validation. Versions 1.3.3 and 2.1.2 contain the patch.

Published Nov 11, 2026

Updated

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2.

Affected Software

1 affected component

composer/jasny/twig-view<1.3.3, <2.1.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade TwigView to a version that resolves this vulnerability.
Fixed in 1.3.3
Upgrade
Upgrade TwigView to a version that resolves this vulnerability.
Fixed in 2.1.2

Event History

Nov 11, 2026

CVE Published

via MITRE·04:24 AM

Data Sourced

via MITRE·04:24 AM

DescriptionWeakness

Data Sourced

via NVD·05:19 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using composer/jasny/twig-view before version 1.3.3 or 2.1.2 are affected only where unvalidated user-controlled input can be supplied to FileLoader::findTemplate().

What does an attacker need to exploit this issue?

An attacker needs a path by which they can control data passed to FileLoader::findTemplate() without validation. No authentication or user interaction is required according to the supplied severity vector.

Are default installations affected?

The issue is conditional rather than inherent to every use of the plugin: exploitation depends on whether the application passes unvalidated user-controlled data to FileLoader::findTemplate().

What should be done if patching cannot happen immediately?

Ensure that input reaching FileLoader::findTemplate() is not user controlled, or strictly validate it before use. Upgrade to version 1.3.3 or 2.1.2 when possible.

How can I determine whether my application is already at risk?

Check the installed composer/jasny/twig-view version and review calls to FileLoader::findTemplate() for values derived from requests or other user-controlled sources without validation. Versions 1.3.3 and 2.1.2 contain the patch.

CVE-2026-59191: TwigView: FileLoader is vulnerable to arbitrary file read

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are default installations affected?

What should be done if patching cannot happen immediately?

How can I determine whether my application is already at risk?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Are default installations affected?

What should be done if patching cannot happen immediately?

How can I determine whether my application is already at risk?