{"id":"CVE-2024-45411","aliases":["CLSA-2026-1783991055","DEBIAN-CVE-2024-45411","DLA-3888-1","DSA-5771-1","EUVD-2024-2735","GHSA-6j75-5wfj-gh66","UBUNTU-CVE-2024-45411","USN-7456-1","USN-7549-1"],"status":"published","title":"Twig has a possible sandbox bypass","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00849,"percentile":0.5863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2024-09-09T18:20:28Z","modified":"2026-11-02T12:02:49Z","fixes":[{"ecosystem":"Packagist","package":"twig/twig","fixed_in":["1.44.8","2.16.1","3.14.0","3.11.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Packagist","package":"twig/twig","fixed_in":["v2.15.6-p1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"php-twig","fixed_in":["3.5.1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"php-twig","fixed_in":["3.8.0-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-twig","fixed_in":["3.8.0-4"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"php-twig","fixed_in":["2.14.3-1+deb11u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","fixed_in":["3.3.8-2ubuntu4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"php-twig","fixed_in":["3.8.0-2ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-twig","fixed_in":["3.8.0-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.44.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.14.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"v2.15.6"},{"fixed":"v2.15.6-p1+tuxcare"}]}],"versions":["v2.15.6"]},{"source":"osv","ecosystem":"Debian:12","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1+deb12u1"}]}],"versions":["3.5.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.3-1+deb11u3"}]}],"versions":["2.14.3-1","2.14.3-1+deb11u1","2.14.3-1+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1+deb12u1"}]}],"versions":["3.5.1-1"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.44.8"}]}],"versions":["1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.11.0","v1.11.1","v1.12.0","v1.12.0-RC1","v1.12.1","v1.12.2","v1.12.3","v1.13.0","v1.13.1","v1.13.2","v1.14.0","v1.14.1","v1.14.2","v1.15.0","v1.15.1","v1.16.0","v1.16.1","v1.16.2","v1.16.3","v1.17.0","v1.18.0","v1.18.1","v1.18.2","v1.19.0","v1.20.0","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.22.1","v1.22.2","v1.22.3","v1.23.0","v1.23.1","v1.23.2","v1.23.3","v1.24.0","v1.24.1","v1.24.2","v1.25.0","v1.26.0","v1.26.1","v1.27.0","v1.28.0","v1.28.1","v1.28.2","v1.29.0","v1.30.0","v1.31.0","v1.32.0","v1.33.0","v1.33.1","v1.33.2","v1.34.0","v1.34.1","v1.34.2","v1.34.3","v1.34.4","v1.35.0","v1.35.1","v1.35.2","v1.35.3","v1.35.4","v1.36.0","v1.37.0","v1.37.1","v1.38.0","v1.38.1","v1.38.2","v1.38.3","v1.38.4","v1.39.0","v1.39.1","v1.40.0","v1.40.1","v1.41.0","v1.42.0","v1.42.1","v1.42.2","v1.42.3","v1.42.4","v1.42.5","v1.43.0","v1.43.1","v1.44.0","v1.44.1","v1.44.2","v1.44.3","v1.44.4","v1.44.5","v1.44.6","v1.44.7","v1.7.0","v1.8.0","v1.8.1","v1.8.2","v1.8.3","v1.9.0","v1.9.1","v1.9.2"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.16.1"}]}],"versions":["v2.0.0","v2.1.0","v2.10.0","v2.11.0","v2.11.1","v2.11.2","v2.11.3","v2.12.0","v2.12.1","v2.12.2","v2.12.3","v2.12.4","v2.12.5","v2.13.0","v2.13.1","v2.14.0","v2.14.1","v2.14.10","v2.14.11","v2.14.12","v2.14.13","v2.14.2","v2.14.3","v2.14.4","v2.14.5","v2.14.6","v2.14.7","v2.14.8","v2.14.9","v2.15.0","v2.15.1","v2.15.2","v2.15.3","v2.15.4","v2.15.5","v2.15.6","v2.16.0","v2.2.0","v2.3.0","v2.3.1","v2.3.2","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.5.0","v2.6.0","v2.6.1","v2.6.2","v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.7.4","v2.8.0","v2.8.1","v2.9.0"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.14.0"}]}],"versions":["v3.12.0","v3.13.0"]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.11.1"}]}],"versions":["v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.0.4","v3.0.5","v3.1.0","v3.1.1","v3.10.0","v3.10.1","v3.10.2","v3.10.3","v3.11.0","v3.2.1","v3.3.0","v3.3.1","v3.3.10","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v3.5.0","v3.5.1","v3.6.0","v3.6.1","v3.7.0","v3.7.1","v3.8.0","v3.9.0","v3.9.1","v3.9.2","v3.9.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4","1.23.1-1ubuntu4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1","2.4.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1","2.12.5-1ubuntu0.1~esm1","2.12.5-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm2"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4","3.3.8-2ubuntu4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu1"}]}],"versions":["3.7.0-1","3.7.1-1","3.8.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu0.1~esm1"}]}],"versions":["3.7.0-1","3.7.1-1","3.8.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.5-1ubuntu0.1~esm2"}]}],"versions":["2.11.3-2","2.12.1-1","2.12.2-1","2.12.3-1","2.12.5-1","2.12.5-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-2ubuntu4+esm2"}]}],"versions":["3.3.2-1ubuntu3","3.3.4-1","3.3.6-1","3.3.7-1","3.3.8-2ubuntu4","3.3.8-2ubuntu4+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu0.1~esm1"}]}],"versions":["3.7.0-1","3.7.1-1","3.8.0-2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu1"}]}],"versions":["3.7.0-1","3.7.1-1","3.8.0-2"]}],"products":[{"vendor":"symfony","product":"twig"},{"vendor":"twigphp","product":"twig"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00031.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45411","tags":["advisory"]},{"url":"https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml","tags":["web"]},{"url":"https://symfony.com/blog/twig-security-release-possible-sandbox-bypass","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6j75-5wfj-gh66"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45411.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45411","tags":["advisory"]},{"url":"https://github.com/twigphp/Twig","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-45411","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45411","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7456-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-51754","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7549-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-45411","title":"Twig has a possible sandbox bypass","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T18:20:28.363Z","modified":"2024-09-16T12:04:18.107Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-2735","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T18:20:28Z","modified":"2024-09-16T12:04:18Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:55.02611Z"}],"ghsa":[{"id":"GHSA-6j75-5wfj-gh66","title":"Twig has a possible sandbox bypass","description":"### Description\n\nUnder some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.\n\nThe security issue happens when all these conditions are met:\n\n * The sandbox is disabled globally;\n * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance;\n * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).\n\n### Resolution\n\nThe patch ensures that the sandbox security checks are always run at runtime.\n\n### Credits\n\nWe would like to thank Fabien Potencier for reporting and fixing the issue.\n","status":"published","published":"2024-09-09T20:19:26Z","modified":"2024-10-10T14:50:23Z","cvss":[{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"},{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:38:09.785133Z"}],"nvd":[{"id":"CVE-2024-45411","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T19:15:13.543Z","modified":"2026-06-17T07:54:09.913Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"CVE-2024-45411","title":"Twig has a possible sandbox bypass","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T18:20:28.363Z","modified":"2026-10-28T02:30:24.969726887Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45411","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T19:15:13.543Z","modified":"2026-11-02T12:02:49.448664377Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-6j75-5wfj-gh66","title":"Twig has a possible sandbox bypass","description":"### Description\n\nUnder some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.\n\nThe security issue happens when all these conditions are met:\n\n * The sandbox is disabled globally;\n * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance;\n * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).\n\n### Resolution\n\nThe patch ensures that the sandbox security checks are always run at runtime.\n\n### Credits\n\nWe would like to thank Fabien Potencier for reporting and fixing the issue.\n","status":"published","published":"2024-09-09T20:19:26Z","modified":"2024-10-10T15:29:44.509458Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":5.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"UBUNTU-CVE-2024-45411","description":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","status":"published","published":"2024-09-09T19:15:00Z","modified":"2026-02-04T09:17:43.864357Z","cvss":[{"version":"3.1","score":8.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"CLSA-2026-1783991055","title":"TuxCare security update for twig/twig (1 CVE)","description":"TuxCare rebuilt twig/twig to address 1 CVE. Fixed in v2.15.6-p1+tuxcare.","status":"published","published":"2026-08-04T14:52:43Z","modified":"2026-10-15T09:47:53.473489188Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"DLA-3888-1","title":"php-twig - security update","status":"published","published":"2024-09-16T00:00:00Z","modified":"2026-03-09T01:18:20.0251Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5771-1","title":"php-twig - security update","status":"published","published":"2024-09-17T00:00:00Z","modified":"2026-03-09T02:10:30.205755Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-7456-1","title":"php-twig vulnerabilities","description":"Fabien Potencier discovered that Twig did not run sandbox security checks\nin some circumstances. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary commands. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-45411)\n\nJamie Schouten discovered that Twig could bypass the security policy for\nan object call. An attacker could possibly use this issue to obtain\nsensitive information. (CVE-2024-51754)\n","status":"published","published":"2025-04-24T12:38:00Z","modified":"2026-04-27T17:55:19.039552Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7549-1","title":"php-twig vulnerability","description":"It was discovered that Twig did not correctly handle securing\nuser input. An attacker could possibly use this issue to cause\nTwig to expose sensitive information if it opened a specially\ncrafted file. (CVE-2024-45411)\n","status":"published","published":"2025-06-02T14:53:12Z","modified":"2026-04-27T18:03:02.870424Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}