Search for vulnerabilities
Vulnerability details: VCID-ra6y-zf7y-zyc7
Vulnerability ID VCID-ra6y-zf7y-zyc7
Aliases CVE-2024-45411
GHSA-6j75-5wfj-gh66
Summary Twig has a possible sandbox bypass ### Description Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. The security issue happens when all these conditions are met: * The sandbox is disabled globally; * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance; * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled). ### Resolution The patch ensures that the sandbox security checks are always run at runtime. ### Credits We would like to thank Fabien Potencier for reporting and fixing the issue.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-693 Protection Mechanism Failure
System Score Found at
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2024-45411
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-6j75-5wfj-gh66
cvssv3.1 8.5 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml
generic_textual MODERATE https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml
cvssv3.1 8.5 https://github.com/twigphp/Twig
generic_textual MODERATE https://github.com/twigphp/Twig
cvssv3.1 8.5 https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
cvssv3.1 8.6 https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
generic_textual MODERATE https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
ssvc Track https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
cvssv3.1 8.5 https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
cvssv3.1 8.6 https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
generic_textual MODERATE https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
ssvc Track https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
cvssv3.1 8.5 https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
generic_textual MODERATE https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
cvssv3.1 8.5 https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
cvssv3.1 8.6 https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
generic_textual MODERATE https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
ssvc Track https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
cvssv3.1 8.5 https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
cvssv3.1 8.6 https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
cvssv3.1_qr MODERATE https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
generic_textual MODERATE https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
ssvc Track https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
cvssv3.1 8.5 https://nvd.nist.gov/vuln/detail/CVE-2024-45411
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-45411
cvssv3.1 8.5 https://symfony.com/blog/twig-security-release-possible-sandbox-bypass
generic_textual MODERATE https://symfony.com/blog/twig-security-release-possible-sandbox-bypass
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-45411
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45411
https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml
https://github.com/twigphp/Twig
https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
https://nvd.nist.gov/vuln/detail/CVE-2024-45411
https://symfony.com/blog/twig-security-release-possible-sandbox-bypass
1081561 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081561
GHSA-6j75-5wfj-gh66 https://github.com/advisories/GHSA-6j75-5wfj-gh66
USN-7456-1 https://usn.ubuntu.com/7456-1/
USN-7549-1 https://usn.ubuntu.com/7549-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2024-45411.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-09T18:37:50Z/ Found at https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-09T18:37:50Z/ Found at https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-09T18:37:50Z/ Found at https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-09-09T18:37:50Z/ Found at https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-45411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Found at https://symfony.com/blog/twig-security-release-possible-sandbox-bypass
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.34141
EPSS Score 0.00134
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:09:21.760798+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-6j75-5wfj-gh66/GHSA-6j75-5wfj-gh66.json 36.1.3