Threat Intelligence Database

Twig, a PHP template language, has a protection mechanism failure vulnerability prior to version 3.27.0. The issue involves the caching of per-template allow-list verdicts for filters, tags, and functions, which can persist after sandbox state changes between renders. This allows a sandboxed render to reuse a template that was originally checked with a different or empty policy. The vulnerability is fixed in version 3.27.0.

Twig, a PHP template language, has an authorization vulnerability prior to version 3.26.0. Several Twig language constructs allow sandboxed template authors to invoke the __toString() method on objects without proper authorization checks. This occurs due to PHP string coercion on Stringable operands bypassing SecurityPolicy::checkMethodAllowed(). The issue is fixed in Twig version 3.26.0.

Twig versions from 3.0.0 up to but not including 3.26.0 contain a cross-site scripting (XSS) vulnerability in the HtmlDumper component of the profiler. This occurs because Profile::getTemplate() and Profile::getName() are written into HTML output without proper escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when rendered in a browser. The issue is fixed starting in version 3.26.0.

Twig versions from 3.24.0 up to but not including 3.26.0 contain a vulnerability where object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false. This disables property and method policy checks, allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. The issue is fixed in version 3.26.0.

Twig, a PHP template language, has a protection mechanism failure vulnerability prior to version 3.26.0. The issue involves the {% sandbox %}{% include %} tags allowing inclusion of templates loaded outside the sandbox without rechecking security policies. This can result in unauthorized use of tags, filters, and functions that should be denied by SecurityPolicy::checkSecurity(). The vulnerability is fixed in version 3.26.0.

Twig versions prior to 3.26.0 have a vulnerability where several filters in twig/markdown-extra and twig/cssinliner-extra are incorrectly registered as safe for all contexts, causing improper encoding or escaping of output. This can lead to unsafe output in HTML, JavaScript, CSS, URL, and other contexts. The issue is fixed in version 3.26.0.

Twig, a PHP template language, has an authorization vulnerability prior to version 3.26.0. The issue arises because the column filter passes object arrays directly to PHP's array_column() function, which accesses public and magic properties without invoking Twig's CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(). This allows an untrusted template author with column in allowedFilters to read properties not permitted by the sandbox allowlist. The vulnerability is fixed in Twig version 3.26.0.

Twig versions from 3.9.0 up to but not including 3.26.0 have a protection mechanism failure in the template_from_string() function. This function compiles inner templates under synthesized names that can bypass sandbox security policies, allowing sandboxed templates to render inner templates without enforcement of security restrictions. The issue is fixed in version 3.26.0.

Twig, a PHP template language, has a code injection vulnerability (CWE-94) in versions prior to 3.26.0. The issue arises because Compiler::string() does not escape single quotes when processing template names from {% use %} tags inside PHP single-quoted string literals. This allows crafted template names to break out of the string context and inject arbitrary PHP code into the compiled cache file. The vulnerability is fixed in Twig version 3.26.0.

Twig prior to version 3.26.0 contains a vulnerability where IntlDateFormatter and NumberFormatter instances are memoized without limits based on template-controlled arguments. This can lead to excessive resource allocation that persists for the lifetime of the Twig environment. The issue is fixed in version 3.26.0.