Path Traversal Affecting twig/twig package, versions >=1.0.0, <1.12.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-TWIGTWIG-7165691
- published 30 May 2024
- disclosed 30 May 2024
- credit Unknown
How to fix?
Upgrade twig/twig to version 1.12.3 or higher.
Overview
twig/twig is a flexible, fast, and secure template language for PHP.
Affected versions of this package are vulnerable to Path Traversal through the filesystem loader. An attacker can access files outside of the intended directory by manipulating template names to include traversal sequences such as /../.
Note
This is only exploitable if the application uses non-trusted template names, such as those provided by an end-user.
References
CVSS Scores
version 3.1