CVE-2022-39261highCWE-22

CVE-2022-39261: falha de alta gravidade em twigphp Twig

Twig may load a template outside a configured directory when using the filesystem loader

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Twig+ Monitorar drupal/core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 3.2%
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
twigphp · Twig
CVEs relacionadas — twigphp Twig

No mesmo produto, das mais perigosas para as menos.

CVE-2022-23614HIGHCode injection in TwigEPSS 8.2%CVE-2024-45411HIGHTwig has a possible sandbox bypassEPSS 0.8%CVE-2026-46633HIGHTwig: PHP code injection via `{% use %}` template nameEPSS 0.8%CVE-2026-24425HIGHTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceEPSS 0.8%CVE-2026-46640HIGHTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationEPSS 0.6%CVE-2026-46634HIGHTwig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameEPSS 0.6%