{"answers":{"affected":"2 open source packages ship an affected version, including twig/twig.","exploited":"There is no known exploitation of GHSA-7cvr-xhm5-x998 in the wild and no public exploit code.","fix":"Upgrade twig/twig to 1.12.3 or later.","what":"GHSA-7cvr-xhm5-x998 is a path traversal vulnerability in twig/twig, published on 30 May 2024. It can be exploited over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-7cvr-xhm5-x998 and fix it if it is affected.\n\nWhat it is: GHSA-7cvr-xhm5-x998 is a path traversal vulnerability in twig/twig, published on 30 May 2024. It can be exploited over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-7cvr-xhm5-x998 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- twig/twig (Packagist): affected from 1.0.0; fixed in 1.12.3\n- twig/twig (Packagist): affected from 1.0.0; fixed in 1.12.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-7cvr-xhm5-x998/ (Markdown: https://insights.sbomify.com/GHSA-7cvr-xhm5-x998/index.md)","id":"GHSA-7cvr-xhm5-x998","markdown":"https://insights.sbomify.com/GHSA-7cvr-xhm5-x998/index.md","name":"GHSA-7cvr-xhm5-x998","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"PHP templating library","requires_auth":"unknown","summary":"Attackers can read files outside the template directory if the application uses untrusted template names with the Twig filesystem loader.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Twig is affected by path traversal vulnerability when used with Twig_Loader_Filesystem for loading Twig templates but only if the application is using non-trusted template names (names provided by a end-user for instance).\n\nWhen affected, it is possible to go up one directory for the paths configured in the application's loader.\n\nFor instance, if the filesystem loader is configured with /path/to/templates as a path to look for templates, an attacker can force Twig to include a file stored in /path/to by prepending the path with /../ like in {% include \"/../somefile_in_path_to\" %}\n\nNote that using anything else (like ../somefile, /../../somefile, or ../../somefile) won’t work and the application will return a proper exception.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Twig Path Traversal vulnerability in the filesystem loader","id":"GHSA-7cvr-xhm5-x998","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["1.12.3"],"introduced":["1.0.0"],"last_affected":[],"package":"twig/twig","purl":null,"source":"GHSA-7cvr-xhm5-x998"},{"ecosystem":"Packagist","fixed":["1.12.3"],"introduced":["1.0.0"],"last_affected":[],"package":"twig/twig","purl":"pkg:composer/twig/twig","source":"GHSA-7cvr-xhm5-x998"}],"products":null,"published":"2024-05-30","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can read files outside the template directory if the application uses untrusted template names with the Twig filesystem loader.","url":"https://insights.sbomify.com/GHSA-7cvr-xhm5-x998/"}