GHSA-7cvr-xhm5-x998 Twig Path Traversal vulnerability in the filesystem loader
Attackers can read files outside the template directory if the application uses untrusted template names with the Twig filesystem loader.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7cvr-xhm5-x998?
GHSA-7cvr-xhm5-x998 is a path traversal vulnerability in twig/twig, published on 30 May 2024. It can be exploited over the network, with no action from the victim.
Official description
Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance).
When affected, it is possible to go up one directory for the paths configured in the application's loader.
For instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include "/../somefile_in_path_to" %}
Note that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.
Which versions are affected by GHSA-7cvr-xhm5-x998?
2 open source packages ship an affected version, including twig/twig.
| Package | Affected | Fixed in |
|---|---|---|
twig/twig Packagist | From 1.0.0 | 1.12.3 |
twig/twig Packagist | From 1.0.0 | 1.12.3 |
How do I fix GHSA-7cvr-xhm5-x998?
Upgrade twig/twig to 1.12.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-7cvr-xhm5-x998 being exploited?
There is no known exploitation of GHSA-7cvr-xhm5-x998 in the wild and no public exploit code.