Description
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
twigphp Twig
> 1.0.0, < 1.44.8affected> 2.0.0, < 2.16.1affected> 3.0.0, < 3.14.0affected
References
- https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66 ↗
- https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6 ↗
- https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de ↗
- https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233 ↗
- https://lists.debian.org/debian-lts-announce/2024/09/msg00031.html ↗