CVE-2022-39261
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
CVE-2022-39261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2022-6700
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
EUVD-2022-6700- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-52m2-vc4m-jj33
Twig may load a template outside a configured directory when using the filesystem loader
Description
When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file (in such a case, validation is bypassed).
Resolution
We fixed validation for such template names.
Even if the 1.x branch is not maintained anymore, a new version has been released.
Credits
We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.
- Record
GHSA-52m2-vc4m-jj33- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
CVE-2022-39261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
CVE-2022-39261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-39261
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
DEBIAN-CVE-2022-39261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-52m2-vc4m-jj33
Twig may load a template outside a configured directory when using the filesystem loader
Description
When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file (in such a case, validation is bypassed).
Resolution
We fixed validation for such template names.
Even if the 1.x branch is not maintained anymore, a new version has been released.
Credits
We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.
- Record
GHSA-52m2-vc4m-jj33- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-39261
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
UBUNTU-CVE-2022-39261- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-drupal-2022-39261 No score
Twig may load a template outside a configured directory when using the filesystem loader
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
- Record
BIT-drupal-2022-39261- Updated
- 2026-11-02
OSVDRUPAL-CORE-2022-016 No score
Drupal uses the Twig third-party library for content templating and sanitization. Twig has released a security update that affects Drupal. Twig has rated the vulnerability as high severity.
Drupal core's code extending Twig has also been updated to mitigate a related vulnerability.
Multiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials.
The vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates.
- Record
DRUPAL-CORE-2022-016- Updated
- 2026-11-02
OSVUSN-5947-1 No score
php-twig, twig vulnerabilities
Fabien Potencier discovered that Twig was not properly enforcing sandbox policies when dealing with objects automatically cast to strings by PHP. An attacker could possibly use this issue to expose sensitive information. This issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM. (CVE-2019-9942)
Marlon Starkloff discovered that Twig was not properly enforcing closure constraints in some of its array filtering functions. An attacker could possibly use this issue to execute arbitrary code. This issue was only fixed in Ubuntu 20.04 ESM. (CVE-2022-23614)
Dariusz Tytko discovered that Twig was not properly verifying input data utilized when defining pathnames used to access files in a system. An attacker could possibly use this issue to access unauthorized resources and expose sensitive information. (CVE-2022-39261)
- Record
USN-5947-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
twig/twigPackagist |
1.0.0 up to 1.44.7 | 1.44.7 |
twig/twigPackagist |
2.0.0 up to 2.15.3 | 2.15.3 |
twig/twigPackagist |
3.0.0 up to 3.4.3 | 3.4.3 |
drupalBitnami |
8.0.0 up to 9.3.22, 9.4.0 up to 9.4.7 | 9.3.229.4.7 |
php-twigDebian:12 |
before 3.4.3-1 | 3.4.3-1 |
php-twigDebian:13 |
before 3.4.3-1 | 3.4.3-1 |
php-twigDebian:14 |
before 3.4.3-1 | 3.4.3-1 |
twigDebian:10 |
before 2.6.2-2+deb10u1, plus listed versions 2.6.2-2 |
2.6.2-2+deb10u1 |
drupal/corePackagist |
8.0.0 up to 9.3.22, 9.4.0 up to 9.4.7, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.28.2.38.2.48.2.58.2.68.2.78.2.88.3.08.3.0-alpha18.3.0-beta18.3.0-rc18.3.0-rc28.3.18.3.28.3.38.3.48.3.58.3.68.3.78.3.88.3.98.4.08.4.0-alpha1 |
9.3.229.4.7 |
php-twigDebian:11 |
before 2.14.3-1+deb11u2, plus listed versions 2.14.3-12.14.3-1+deb11u1 |
2.14.3-1+deb11u2 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
twig/twigPackagist |
1.0.0 up to 1.44.7, plus listed versions 1.3.01.4.01.5.01.5.11.6.0 Show 45 moreShow less1.6.11.6.21.6.31.6.41.6.5v1.10.0v1.10.1v1.10.2v1.10.3v1.11.0v1.11.1v1.12.0v1.12.0-RC1v1.12.1v1.12.2v1.12.3v1.13.0v1.13.1v1.13.2v1.14.0v1.14.1v1.14.2v1.15.0v1.15.1v1.16.0v1.16.1v1.16.2v1.16.3v1.17.0v1.18.0v1.18.1v1.18.2v1.19.0v1.20.0v1.21.0v1.21.1v1.21.2v1.22.0v1.22.1v1.22.2v1.22.3v1.23.0v1.23.1v1.23.2v1.23.3 |
1.44.7 |
twig/twigPackagist |
2.0.0 up to 2.15.3, plus listed versions v2.0.0v2.1.0v2.10.0v2.11.0v2.11.1 Show 45 moreShow lessv2.11.2v2.11.3v2.12.0v2.12.1v2.12.2v2.12.3v2.12.4v2.12.5v2.13.0v2.13.1v2.14.0v2.14.1v2.14.10v2.14.11v2.14.12v2.14.13v2.14.2v2.14.3v2.14.4v2.14.5v2.14.6v2.14.7v2.14.8v2.14.9v2.15.0v2.15.1v2.15.2v2.2.0v2.3.0v2.3.1v2.3.2v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.4.5v2.4.6v2.4.7v2.4.8v2.5.0v2.6.0v2.6.1v2.6.2v2.7.0 |
2.15.3 |
twig/twigPackagist |
3.0.0 up to 3.4.3, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 18 moreShow lessv3.0.5v3.1.0v3.1.1v3.2.1v3.3.0v3.3.1v3.3.10v3.3.2v3.3.3v3.3.4v3.3.5v3.3.6v3.3.7v3.3.8v3.3.9v3.4.0v3.4.1v3.4.2 |
3.4.3 |
twigUbuntu:Pro:16.04:LTS |
before 1.23.1-1ubuntu4+esm1, plus listed versions 1.20.0-11.23.1-1ubuntu11.23.1-1ubuntu4 |
1.23.1-1ubuntu4+esm1 |
twigUbuntu:Pro:18.04:LTS |
before 2.4.6-1ubuntu0.1~esm1, plus listed versions 1.24.0-2ubuntu12.4.4-2ubuntu12.4.6-1 |
2.4.6-1ubuntu0.1~esm1 |
php-twigUbuntu:Pro:20.04:LTS |
before 2.12.5-1ubuntu0.1~esm1, plus listed versions 2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-1 |
2.12.5-1ubuntu0.1~esm1 |
php-twigUbuntu:Pro:22.04:LTS |
before 3.3.8-2ubuntu4+esm1, plus listed versions 3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu4 |
3.3.8-2ubuntu4+esm1 |
twigUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 1.23.1-1ubuntu4+esm1, plus listed versions 1.20.0-11.23.1-1ubuntu11.23.1-1ubuntu4 |
1.23.1-1ubuntu4+esm1 |
twigUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.4.6-1ubuntu0.1~esm1, plus listed versions 1.24.0-2ubuntu12.4.4-2ubuntu12.4.6-1 |
2.4.6-1ubuntu0.1~esm1 |
php-twigUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 2.12.5-1ubuntu0.1~esm1, plus listed versions 2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-1 |
2.12.5-1ubuntu0.1~esm1 |
php-twigUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 3.3.8-2ubuntu4+esm1, plus listed versions 3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu4 |
3.3.8-2ubuntu4+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39261 is a high vulnerability (CVSS 7.5) in Symfony Twig, published September 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.17%, the 88th percentile. Fixed in twig/twig 1.44.7.
References
github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33
drupal.org/sa-core-2022-016
debian.org/security/2022/dsa-5248
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7
Show 23 moreShow less
lists.debian.org/debian-lts-announce/2022/10/msg00016.html
nvd.nist.gov/vuln/detail/CVE-2022-39261
symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader
security-tracker.debian.org/tracker/CVE-2022-39261
ubuntu.com/security/CVE-2022-39261
cve.org/CVERecord?id=CVE-2022-39261
Left out here: 286 versions. The JSON record has them.