{"id":"CVE-2019-9942","aliases":["DEBIAN-CVE-2019-9942","DSA-4419-1","EUVD-2022-1558","GHSA-vxrc-68xx-x48g","UBUNTU-CVE-2019-9942","USN-5947-1"],"status":"published","title":"Twig Sandbox Information Disclosure","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01405,"percentile":0.7275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2019-03-23T14:31:53Z","modified":"2026-10-20T10:51:43Z","fixes":[{"ecosystem":"Packagist","package":"twig/twig","fixed_in":["1.38.0","2.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:9","package":"twig","fixed_in":["1.24.0-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","fixed_in":["1.23.1-1ubuntu4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","fixed_in":["2.4.6-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.7.0"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2+deb9u1"}]}],"versions":["1.24.0-2"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.0"}]}],"versions":["1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.11.0","v1.11.1","v1.12.0","v1.12.0-RC1","v1.12.1","v1.12.2","v1.12.3","v1.13.0","v1.13.1","v1.13.2","v1.14.0","v1.14.1","v1.14.2","v1.15.0","v1.15.1","v1.16.0","v1.16.1","v1.16.2","v1.16.3","v1.17.0","v1.18.0","v1.18.1","v1.18.2","v1.19.0","v1.20.0","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.22.1","v1.22.2","v1.22.3","v1.23.0","v1.23.1","v1.23.2","v1.23.3","v1.24.0","v1.24.1","v1.24.2","v1.25.0","v1.26.0","v1.26.1","v1.27.0","v1.28.0","v1.28.1","v1.28.2","v1.29.0","v1.30.0","v1.31.0","v1.32.0","v1.33.0","v1.33.1","v1.33.2","v1.34.0","v1.34.1","v1.34.2","v1.34.3","v1.34.4","v1.35.0","v1.35.1","v1.35.2","v1.35.3","v1.35.4","v1.36.0","v1.37.0","v1.37.1","v1.7.0","v1.8.0","v1.8.1","v1.8.2","v1.8.3","v1.9.0","v1.9.1","v1.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.7.0"}]}],"versions":["v2.0.0","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.5.0","v2.6.0","v2.6.1","v2.6.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1ubuntu4+esm1"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1ubuntu0.1~esm1"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1ubuntu4+esm1"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1ubuntu0.1~esm1"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm1"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm1"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"symfony","product":"twig"}],"references":[{"url":"https://symfony.com/blog/twig-sandbox-information-disclosure","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/eac5422956e1dcca89a3669a03a3ff32f0502077","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://www.debian.org/security/2019/dsa-4419","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Mar/60","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9942","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2019-9942.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vxrc-68xx-x48g"},{"url":"https://github.com/twigphp/Twig","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2019-9942","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5947-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23614","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-39261","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-9942","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","status":"published","published":"2019-03-23T14:31:53Z","modified":"2024-08-04T22:10:08.258Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2022-1558","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","status":"published","published":"2019-03-23T14:31:53Z","modified":"2024-08-04T22:10:08Z","updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-vxrc-68xx-x48g","title":"Twig Sandbox Information Disclosure","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the `__toString()` method on an object even if not allowed by the security policy in place.","status":"published","published":"2022-03-26T00:25:25Z","modified":"2023-09-21T19:49:04Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2019-9942","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","status":"published","published":"2019-03-23T15:29:00.323Z","modified":"2026-06-17T02:44:53.95Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-9942","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","status":"published","published":"2019-03-23T15:29:00.323Z","modified":"2026-10-20T10:51:43.970923053Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"GHSA-vxrc-68xx-x48g","title":"Twig Sandbox Information Disclosure","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the `__toString()` method on an object even if not allowed by the security policy in place.","status":"published","published":"2022-03-26T00:25:25Z","modified":"2024-02-16T08:12:09.652191Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"UBUNTU-CVE-2019-9942","description":"A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.","status":"published","published":"2019-03-23T15:29:00Z","modified":"2026-02-04T02:40:00.507285Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"},{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DSA-4419-1","title":"twig - security update","status":"published","published":"2019-03-29T00:00:00Z","modified":"2026-03-09T02:09:04.476977Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-5947-1","title":"php-twig, twig vulnerabilities","description":"Fabien Potencier discovered that Twig was not properly enforcing sandbox\npolicies when dealing with objects automatically cast to strings by PHP.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-9942)\n\nMarlon Starkloff discovered that Twig was not properly enforcing closure\nconstraints in some of its array filtering functions. An attacker could\npossibly use this issue to execute arbitrary code. This issue was only\nfixed in Ubuntu 20.04 ESM. (CVE-2022-23614)\n\nDariusz Tytko discovered that Twig was not properly verifying input data\nutilized when defining pathnames used to access files in a system. An\nattacker could possibly use this issue to access unauthorized resources\nand expose sensitive information. (CVE-2022-39261)\n","status":"published","published":"2023-03-13T10:55:33Z","modified":"2026-06-25T13:31:52.941324068Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}