CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
AI Score
Confidence
Low
EPSS
Percentile
48.5%
Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.
The security issue happens when all these conditions are met:
include()
function which references a template name (like included.twig
) and not a Template
or TemplateWrapper
instance;include()
call but in a non-sandbox context (possible as the sandbox has been globally disabled).The patch ensures that the sandbox security checks are always run at runtime.
We would like to thank Fabien Potencier for reporting and fixing the issue.
github.com/advisories/GHSA-6j75-5wfj-gh66
github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
nvd.nist.gov/vuln/detail/CVE-2024-45411
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
AI Score
Confidence
Low
EPSS
Percentile
48.5%