Vulnerability advisory
CVE-2022-39261
Twig may load a template outside a configured directory when using the filesystem loader
Also known as BIT-drupal-2022-39261DRUPAL-CORE-2022-016GHSA-52m2-vc4m-jj33
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/drupal/drupal ↗ | |
| 35c2f3ca5c935f3d8bde15932a712677c9bbd50f to before e637df2c3679a3eb768675681220e74a5ee51a18 | e637df2c3679a3eb768675681220e74a5ee51a18 |
| 970c1b5cfa946f683de326a3f252b5371a42186a to before 89d5167a40092f646c810b52ad7bde1f091ee73f | 89d5167a40092f646c810b52ad7bde1f091ee73f |
| GIT github.com/twigphp/twig ↗ | |
| 2f106a80cc13b4260074e573fa017a770fe20350 to before 0887422319889e442458e48e2f3d9add1a172ad5 | 0887422319889e442458e48e2f3d9add1a172ad5 |
| 2a86dde1288d7270169083d0e078dc7ebe0f48b6 to before ab402673db8746cb3a4c46f3869d6253699f614a | ab402673db8746cb3a4c46f3869d6253699f614a |
| 9b58bb8ac7a41d72fbb5a7dc643e07923e5ccc26 to before c38fd6b0b7f370c198db91ffd02e23b517426b58 | c38fd6b0b7f370c198db91ffd02e23b517426b58 |
| Not specified | 35f3035c5deb0041da7b84daf02dea074ddc7a0b |
Also listed as affected (233)
| |
Description
Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.
References
- Webwww.drupal.org/sa-core-2022-016 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39261.json ↗
- Advisorygithub.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33 ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F/ ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-39261 ↗
- Advisorywww.debian.org/security/2022/dsa-5248 ↗
- Fixgithub.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b ↗
- ARTICLElists.debian.org/debian-lts-announce/2022/10/msg00016.html ↗