{"id":"CVE-2022-39261","aliases":["BIT-drupal-2022-39261","DEBIAN-CVE-2022-39261","DLA-3147-1","DRUPAL-CORE-2022-016","DSA-5248-1","EUVD-2022-6700","GHSA-52m2-vc4m-jj33","UBUNTU-CVE-2022-39261","USN-5947-1"],"status":"published","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03174,"percentile":0.88125,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2022-09-28T00:00:00Z","modified":"2026-11-03T08:03:05Z","fixes":[{"ecosystem":"Packagist","package":"twig/twig","fixed_in":["1.44.7","2.15.3","3.4.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"drupal","fixed_in":["9.3.22","9.4.7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-twig","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-twig","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-twig","fixed_in":["3.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"twig","fixed_in":["2.6.2-2+deb10u1"],"sources":["osv"]},{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["9.3.22","9.4.7"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php-twig","fixed_in":["2.14.3-1+deb11u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","fixed_in":["1.23.1-1ubuntu4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","fixed_in":["2.4.6-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","fixed_in":["2.12.5-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","fixed_in":["3.3.8-2ubuntu4+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.44.7"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.15.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.4.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"drupal","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"9.3.22"},{"introduced":"9.4.0"},{"fixed":"9.4.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2+deb10u1"}]}],"versions":["2.6.2-2"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"9.3.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.7"}]}],"versions":["8.0.0","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2","8.2.3","8.2.4","8.2.5","8.2.6","8.2.7","8.2.8","8.3.0","8.3.0-alpha1","8.3.0-beta1","8.3.0-rc1","8.3.0-rc2","8.3.1","8.3.2","8.3.3","8.3.4","8.3.5","8.3.6","8.3.7","8.3.8","8.3.9","8.4.0","8.4.0-alpha1","8.4.0-beta1","8.4.0-rc1","8.4.0-rc2","8.4.1","8.4.2","8.4.3","8.4.4","8.4.5","8.4.6","8.4.7","8.4.8","8.5.0","8.5.0-alpha1","8.5.0-beta1","8.5.0-rc1","8.5.1","8.5.10","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.2","8.5.3","8.5.4","8.5.5","8.5.6","8.5.7","8.5.8","8.5.9","8.6.0","8.6.0-alpha1","8.6.0-beta1","8.6.0-beta2","8.6.0-rc1","8.6.1","8.6.10","8.6.11","8.6.12","8.6.13","8.6.14","8.6.15","8.6.16","8.6.17","8.6.18","8.6.2","8.6.3","8.6.4","8.6.5","8.6.6","8.6.7","8.6.8","8.6.9","8.7.0","8.7.0-alpha1","8.7.0-alpha2","8.7.0-beta1","8.7.0-beta2","8.7.0-rc1","8.7.1","8.7.10","8.7.11","8.7.12","8.7.13","8.7.14","8.7.2","8.7.3","8.7.4","8.7.5","8.7.6","8.7.7","8.7.8","8.7.9","8.8.0","8.8.0-alpha1","8.8.0-beta1","8.8.0-rc1","8.8.1","8.8.10","8.8.11","8.8.12","8.8.2","8.8.3","8.8.4","8.8.5","8.8.6","8.8.7","8.8.8","8.8.9","8.9.0","8.9.0-beta1","8.9.0-beta2","8.9.0-beta3","8.9.0-rc1","8.9.1","8.9.10","8.9.11","8.9.12","8.9.13","8.9.14","8.9.15","8.9.16","8.9.17","8.9.18","8.9.19","8.9.2","8.9.20","8.9.3","8.9.4","8.9.5","8.9.6","8.9.7","8.9.8","8.9.9","9.0.0","9.0.0-alpha1","9.0.0-alpha2","9.0.0-beta1","9.0.0-beta2","9.0.0-beta3","9.0.0-rc1","9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.0-alpha1","9.1.0-beta1","9.1.0-rc1","9.1.0-rc2","9.1.0-rc3","9.1.1","9.1.10","9.1.11","9.1.12","9.1.13","9.1.14","9.1.15","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.0-alpha1","9.2.0-beta1","9.2.0-beta2","9.2.0-beta3","9.2.0-rc1","9.2.1","9.2.10","9.2.11","9.2.12","9.2.13","9.2.14","9.2.15","9.2.16","9.2.17","9.2.18","9.2.19","9.2.2","9.2.20","9.2.21","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.0-alpha1","9.3.0-beta1","9.3.0-beta2","9.3.0-beta3","9.3.0-rc1","9.3.1","9.3.10","9.3.11","9.3.12","9.3.13","9.3.14","9.3.15","9.3.16","9.3.17","9.3.18","9.3.19","9.3.2","9.3.20","9.3.21","9.3.3","9.3.4","9.3.5","9.3.6","9.3.7","9.3.8","9.3.9","9.4.0","9.4.1","9.4.2","9.4.3","9.4.4","9.4.5","9.4.6"]},{"source":"osv","ecosystem":"Debian:11","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1+deb11u2"}]}],"versions":["2.14.3-1","2.14.3-1+deb11u1"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.44.7"}]}],"versions":["1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.11.0","v1.11.1","v1.12.0","v1.12.0-RC1","v1.12.1","v1.12.2","v1.12.3","v1.13.0","v1.13.1","v1.13.2","v1.14.0","v1.14.1","v1.14.2","v1.15.0","v1.15.1","v1.16.0","v1.16.1","v1.16.2","v1.16.3","v1.17.0","v1.18.0","v1.18.1","v1.18.2","v1.19.0","v1.20.0","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.22.1","v1.22.2","v1.22.3","v1.23.0","v1.23.1","v1.23.2","v1.23.3","v1.24.0","v1.24.1","v1.24.2","v1.25.0","v1.26.0","v1.26.1","v1.27.0","v1.28.0","v1.28.1","v1.28.2","v1.29.0","v1.30.0","v1.31.0","v1.32.0","v1.33.0","v1.33.1","v1.33.2","v1.34.0","v1.34.1","v1.34.2","v1.34.3","v1.34.4","v1.35.0","v1.35.1","v1.35.2","v1.35.3","v1.35.4","v1.36.0","v1.37.0","v1.37.1","v1.38.0","v1.38.1","v1.38.2","v1.38.3","v1.38.4","v1.39.0","v1.39.1","v1.40.0","v1.40.1","v1.41.0","v1.42.0","v1.42.1","v1.42.2","v1.42.3","v1.42.4","v1.42.5","v1.43.0","v1.43.1","v1.44.0","v1.44.1","v1.44.2","v1.44.3","v1.44.4","v1.44.5","v1.44.6","v1.7.0","v1.8.0","v1.8.1","v1.8.2","v1.8.3","v1.9.0","v1.9.1","v1.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.15.3"}]}],"versions":["v2.0.0","v2.1.0","v2.10.0","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.10","v2.14.11","v2.14.12","v2.14.13","v2.14.2","v2.14.3","v2.14.4","v2.14.5","v2.14.6","v2.14.7","v2.14.8","v2.14.9","v2.15.0","v2.15.1","v2.15.2","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.5.0","v2.6.0","v2.6.1","v2.6.2","v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.8.0","v2.8.1","v2.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.4.3"}]}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.2.1","v3.3.0","v3.3.1","v3.3.10","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1ubuntu4+esm1"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1ubuntu0.1~esm1"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm1"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm1"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.1-1ubuntu4+esm1"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1ubuntu0.1~esm1"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm1"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm1"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4"],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"symfony","product":"twig"},{"vendor":"twigphp","product":"twig"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33","tags":["x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b","tags":["x_transferred","Patch","Third Party Advisory","advisory","fix","web","report"]},{"url":"https://www.drupal.org/sa-core-2022-016","tags":["x_transferred","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://www.debian.org/security/2022/dsa-5248","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39261","tags":["web","advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml","tags":["web"]},{"url":"https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/"},{"url":"https://github.com/advisories/GHSA-52m2-vc4m-jj33"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39261.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-39261","tags":["advisory"]},{"url":"https://github.com/twigphp/Twig","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-39261","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5947-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-39261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9942","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23614","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-39261","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T00:00:00Z","modified":"2025-04-23T16:54:59.321Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-6700","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T00:00:00Z","modified":"2025-04-23T16:54:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:11.440801Z"}],"ghsa":[{"id":"GHSA-52m2-vc4m-jj33","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"# Description\n\nWhen using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).\n\n# Resolution\n\nWe fixed validation for such template names.\n\nEven if the 1.x branch is not maintained anymore, a new version has been released.\n\n# Credits\n\nWe would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.\n","status":"published","published":"2022-09-30T05:29:36Z","modified":"2023-01-27T05:03:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:20.144464Z"}],"nvd":[{"id":"CVE-2022-39261","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T14:15:10.827Z","modified":"2026-06-17T04:58:01.43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-39261","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T00:00:00Z","modified":"2026-10-28T02:31:00.438340607Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-39261","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T14:15:10.827Z","modified":"2026-11-03T08:03:05.256585239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-52m2-vc4m-jj33","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"# Description\n\nWhen using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).\n\n# Resolution\n\nWe fixed validation for such template names.\n\nEven if the 1.x branch is not maintained anymore, a new version has been released.\n\n# Credits\n\nWe would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.\n","status":"published","published":"2022-09-30T05:29:36Z","modified":"2025-12-10T23:41:22.048357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2022-39261","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2022-09-28T14:15:00Z","modified":"2026-02-04T23:49:13.512486Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"BIT-drupal-2022-39261","title":"Twig may load a template outside a configured directory when using the filesystem loader","description":"Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.","status":"published","published":"2024-03-06T10:51:53.277Z","modified":"2026-09-08T08:47:03.371523324Z","updated_at":"2026-11-02T15:28:29.563843Z"},{"id":"DLA-3147-1","title":"twig - security update","status":"published","published":"2022-10-11T00:00:00Z","modified":"2026-03-09T01:20:50.368024Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DRUPAL-CORE-2022-016","description":"Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has released a security update](https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader) that affects Drupal. Twig has rated the vulnerability as high severity.\n\nDrupal core's code extending Twig has also been updated to mitigate a related vulnerability.\n\nMultiple vulnerabilities are possible if an untrusted user has access to write Twig code, including potential unauthorized read access to private files, the contents of other files on the server, or database credentials.\n\nThe vulnerability is mitigated by the fact that an exploit is only possible in Drupal core with a restricted access administrative permission. Additional exploit paths for the same vulnerability may exist with contributed or custom code that allows users to write Twig templates.","status":"published","published":"2022-09-28T16:24:08Z","modified":"2026-09-19T18:18:33Z","updated_at":"2026-11-02T15:46:13.900249Z"},{"id":"DSA-5248-1","title":"php-twig - security update","status":"published","published":"2022-10-05T00:00:00Z","modified":"2026-03-09T02:09:51.172587Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"USN-5947-1","title":"php-twig, twig vulnerabilities","description":"Fabien Potencier discovered that Twig was not properly enforcing sandbox\npolicies when dealing with objects automatically cast to strings by PHP.\nAn attacker could possibly use this issue to expose sensitive information.\nThis issue was only fixed in Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.\n(CVE-2019-9942)\n\nMarlon Starkloff discovered that Twig was not properly enforcing closure\nconstraints in some of its array filtering functions. An attacker could\npossibly use this issue to execute arbitrary code. This issue was only\nfixed in Ubuntu 20.04 ESM. (CVE-2022-23614)\n\nDariusz Tytko discovered that Twig was not properly verifying input data\nutilized when defining pathnames used to access files in a system. An\nattacker could possibly use this issue to access unauthorized resources\nand expose sensitive information. (CVE-2022-39261)\n","status":"published","published":"2023-03-13T10:55:33Z","modified":"2026-06-25T13:31:52.941324068Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}