Sensio Labs Twig Path Traversal Vulnerability

Sensio Labs Twig is a PHP template engine from the French company Sensio Labs that supports custom tags and filters and the creation of DSLs. Sensio Labs Twig 1.0.0 and later, versions prior to 1.44.7, 2.0.0 and later, versions prior to 2.15.3 and 3.0.0 and later, and 3.4. A path traversal vulnerability exists in versions prior to 3. The vulnerability stems from the failure of a networked system or product to properly filter special elements in a resource or file path. An attacker could exploit the vulnerability to read arbitrary files from outside the template directory using source and include when using a specific namespace.