CVE-2022-39261

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-39261
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39261.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-39261
Aliases
Related
Published
2022-09-28T14:15:10Z
Modified
2024-09-18T03:22:21.809622Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the source or include statement to read arbitrary files from outside the templates' directory when using a namespace like @somewhere/../some.file. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.

References

Affected packages

Debian:11 / php-twig

Package

Name
php-twig
Purl
pkg:deb/debian/php-twig?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.3-1+deb11u2

Affected versions

2.*

2.14.3-1
2.14.3-1+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / php-twig

Package

Name
php-twig
Purl
pkg:deb/debian/php-twig?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / php-twig

Package

Name
php-twig
Purl
pkg:deb/debian/php-twig?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.4.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/drupal/drupal

Affected ranges

Type
GIT
Repo
https://github.com/drupal/drupal
Events
Introduced
35c2f3ca5c935f3d8bde15932a712677c9bbd50f
Fixed
e637df2c3679a3eb768675681220e74a5ee51a18
Type
GIT
Repo
https://github.com/twigphp/twig
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
35f3035c5deb0041da7b84daf02dea074ddc7a0b

Affected versions

8.*

8.0.0
8.1.0-beta1

9.*

9.0.0-alpha1
9.0.0-alpha2
9.3.0
9.3.0-alpha1
9.3.0-beta1
9.3.0-beta2
9.3.0-beta3
9.3.0-rc1
9.3.10
9.3.11
9.3.12
9.3.13
9.3.14
9.3.15
9.3.16
9.3.17
9.3.18
9.3.19
9.3.2
9.3.20
9.3.21
9.3.3
9.3.4
9.3.5
9.3.6
9.3.7
9.3.8
9.3.9

v0.*

v0.9.0
v0.9.1
v0.9.10
v0.9.2
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9

v1.*

v1.0.0
v1.0.0-RC1
v1.0.0-RC2
v1.1.0
v1.1.0-RC1
v1.1.0-RC2
v1.1.0-RC3
v1.1.1
v1.1.2
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.11.0
v1.11.1
v1.12.0
v1.12.0-RC1
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.2
v1.14.0
v1.14.1
v1.14.2
v1.15.0
v1.15.1
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.2.0
v1.2.0-RC1
v1.20.0
v1.21.0
v1.21.1
v1.21.2
v1.22.0
v1.22.1
v1.22.2
v1.22.3
v1.23.0
v1.23.1
v1.23.2
v1.23.3
v1.24.0
v1.24.1
v1.24.2
v1.25.0
v1.26.0
v1.26.1
v1.27.0
v1.28.0
v1.28.1
v1.28.2
v1.29.0
v1.3.0
v1.3.0-RC1
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.33.1
v1.33.2
v1.34.0
v1.34.1
v1.34.2
v1.34.3
v1.34.4
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.35.4
v1.36.0
v1.37.0
v1.37.1
v1.38.0
v1.38.1
v1.38.2
v1.38.3
v1.38.4
v1.39.0
v1.39.1
v1.4.0
v1.4.0-RC1
v1.4.0-RC2
v1.40.0
v1.40.1
v1.41.0
v1.42.0
v1.42.1
v1.42.2
v1.42.3
v1.42.4
v1.42.5
v1.43.0
v1.43.1
v1.44.0
v1.44.1
v1.44.2
v1.44.3
v1.44.4
v1.44.5
v1.44.6
v1.5.0
v1.5.0-RC1
v1.5.0-RC2
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.9.0
v1.9.1
v1.9.2