Ubuntu.comUB:CVE-2022-39261CVE-2022-39261
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.003 Low
EPSS
Percentile
71.2%
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x
prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the
filesystem loader loads templates for which the name is a user input. It is
possible to use the source or include statement to read arbitrary files
from outside the templates’ directory when using a namespace like
@somewhere/../some.file. In such a case, validation is bypassed. Versions
1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template
names. There are no known workarounds aside from upgrading.
References
github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b
github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b (v1.44.7, v2.15.3, v3.4.3)
github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33
launchpad.net/bugs/cve/CVE-2022-39261
nvd.nist.gov/vuln/detail/CVE-2022-39261
security-tracker.debian.org/tracker/CVE-2022-39261
ubuntu.com/security/notices/USN-5947-1
www.cve.org/CVERecord?id=CVE-2022-39261
www.drupal.org/sa-core-2022-016
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.003 Low
EPSS
Percentile
71.2%