CVE-2015-7809 Twig remote code execution in templates
Remote attackers can execute arbitrary code in Twig templates when Sandbox mode is enabled, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-7809?
CVE-2015-7809 is a medium-severity code injection vulnerability in n/a, published on 6 Nov 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Weakness: CWE-264
Which versions are affected by CVE-2015-7809?
2 open source packages ship an affected version, including twig/twig. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twig/twig Packagist | All versions | 1.20.0 |
twig/twig Packagist | All versions | 1.20.0 |
Products include Symfony Twig.
How do I fix CVE-2015-7809?
Upgrade twig/twig to 1.20.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-7809 being exploited?
There is no known exploitation of CVE-2015-7809 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13818 Code injection in n/a
- CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name
- CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
- CVE-2024-45411 Twig has a possible sandbox bypass
Sources
Also known as DSA-3343-1, GHSA-xw83-pwrm-9j74.