CVE-2022-39261

2022-09-2800:00:00

ubuntu.com

120

twig

php

template language

arbitrary file read

filesystem loader

security vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.003

Percentile

71.1%

JSON

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x
prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the
filesystem loader loads templates for which the name is a user input. It is
possible to use the source or include statement to read arbitrary files
from outside the templates’ directory when using a namespace like
@somewhere/../some.file. In such a case, validation is bypassed. Versions
1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template
names. There are no known workarounds aside from upgrading.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchphp-twig< 2.12.5-1ubuntu0.1~esm1UNKNOWN
ubuntu22.04noarchphp-twig< 3.3.8-2ubuntu4+esm1UNKNOWN
ubuntu18.04noarchtwig< 2.4.6-1ubuntu0.1~esm1UNKNOWN
ubuntu16.04noarchtwig< 1.23.1-1ubuntu4+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	php-twig	< 2.12.5-1ubuntu0.1~esm1	UNKNOWN
ubuntu	22.04	noarch	php-twig	< 3.3.8-2ubuntu4+esm1	UNKNOWN
ubuntu	18.04	noarch	twig	< 2.4.6-1ubuntu0.1~esm1	UNKNOWN
ubuntu	16.04	noarch	twig	< 1.23.1-1ubuntu4+esm1	UNKNOWN