Threat Intelligence Database

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

Twig before version 3.26.0 improperly marks several filters in twig/markdown-extra and twig/cssinliner-extra as safe for all output contexts, including HTML, JavaScript, CSS, and URLs, without proper escaping. This can lead to improper encoding or escaping of output, potentially causing security issues. The vulnerability is fixed in version 3.26.0.

Twig, a PHP template language, has a protection mechanism failure vulnerability prior to version 3.26.0. The issue involves the sandbox feature where {% sandbox %}{% include %} can include a template previously loaded outside the sandbox without re-checking security policies. This allows cached templates to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). The vulnerability is fixed in version 3.26.0.

Twig versions prior to 3.26.0 contain a vulnerability where IntlDateFormatter and NumberFormatter instances are memoized without limits based on template-controlled arguments. This can lead to excessive resource allocation that persists for the lifetime of the Twig environment. The issue is addressed in version 3.26.0.

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

Twig, a PHP template language, has an improper encoding vulnerability in versions prior to 3.26.0. The deprecated spaceless filter is incorrectly registered as safe for HTML, which causes Twig's autoescaping mechanism to fail and emit unescaped attacker-controlled markup when spaceless is applied to untrusted input. This vulnerability is fixed in version 3.26.0.

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.

Twig versions prior to 3.26.0 have a vulnerability in the sandbox feature that allows untrusted templates to consume excessive CPU, memory, or wall-clock time, leading to resource exhaustion. The issue is documented in version 3.26.0, clarifying that the sandbox does not protect against such resource consumption. This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has a high severity rating with a CVSS score of 7.1.

Twig versions prior to 3.26.0 contain a code injection vulnerability due to improper escaping of single quotes in template names used in {% use %} tags. This allows crafted template names to inject arbitrary PHP code into compiled cache files. The issue is fixed in version 3.26.0.

Twig versions from 3.24.0 up to but not including 3.26.0 contain a protection mechanism failure where sandbox policy checks are disabled during object-destructuring assignment. This allows an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. The issue is fixed in version 3.26.0.