Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-ummk-h11z-bkaj
|
Twig may load a template outside a configured directory when using the filesystem loader
# Description
When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).
# Resolution
We fixed validation for such template names.
Even if the 1.x branch is not maintained anymore, a new version has been released.
# Credits
We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.
|
CVE-2022-39261
GHSA-52m2-vc4m-jj33
|