Package Instance

Twig Path Traversal vulnerability in the filesystem loader
Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance).

When affected, it is possible to go up one directory for the paths configured in the application's loader.

For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %}

Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.

Twig has a possible sandbox bypass
### Description

Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.

The security issue happens when all these conditions are met:

 * The sandbox is disabled globally;
 * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance;
 * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled).

### Resolution

The patch ensures that the sandbox security checks are always run at runtime.

### Credits

We would like to thank Fabien Potencier for reporting and fixing the issue.

Twig may load a template outside a configured directory when using the filesystem loader
# Description

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).

# Resolution

We fixed validation for such template names.

Even if the 1.x branch is not maintained anymore, a new version has been released.

# Credits

We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

Path Traversal
Vulnerability in the filesystem loader.