Search for vulnerabilities
Vulnerability details: VCID-d8qg-sq4y-93bz
Vulnerability ID VCID-d8qg-sq4y-93bz
Aliases GMS-2015-19
Summary Remote Code Execution Your application is affected if you allow end users to submit Twig templates, even if you protected this template with Twig's sandbox mode. End users can craft valid Twig code that allows them to execute arbitrary code (RCEs) via the _self variable, which is always available, even in sandboxed templates.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/twigphp/Twig/commit/30be07759a3de2558da5224f127d052ecf492e8f
https://github.com/twigphp/Twig/pull/1759
https://symfony.com/blog/security-release-twig-1-20-0
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2025-07-01T18:10:06.828571+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/twig/twig/GMS-2015-19.yml 36.1.3