CVE-2022-39261: Twig/twig Twig May Load A Template Vulnerability

Q: What is CVE-2022-39261?

CVE-2022-39261 is a security vulnerability in Twig/twig involving Twig may load a template outside a configured directory when using the filesystem loader under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Q: Which Twig/twig versions are affected?

Affected versions include releases prior to 1.44.7, 2.15.3, 3.4.3 across affected packages: twig/twig.

Q: What version fixes CVE-2022-39261?

Upgrading to 1.44.7, 2.15.3, 3.4.3 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is twig/twig affected?

Yes, twig/twig is affected in releases prior to 1.44.7, 2.15.3, 3.4.3. Upgrade your dependency to 1.44.7, 2.15.3, 3.4.3 or later.

Q: What is the CVSS score of CVE-2022-39261?

CVE-2022-39261 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2022-39261?

CVE-2022-39261 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

Q: How can I check Packagist dependencies for CVE-2022-39261?

Run the dependency tree command: 'inspect dependencies for twig/twig'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-52m2-vc4m-jj33

CVSS 7.5

CWE-22

Published 2022-09-30

Advisory Summary

CVE-2022-39261 is a HIGH (CVSS 7.5) twig may load a template vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Twig/twig libraries in the Packagist ecosystem. The issue involves twig may load a template outside a configured directory when using the filesystem loader. Remediation is available by upgrading affected packages to version 1.44.7, 2.15.3, 3.4.3.

CVE-2022-39261 at a Glance

CVE Identifier CVE-2022-39261

GHSA Identifier GHSA-52m2-vc4m-jj33

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Product Twig/twig

Package Ecosystem Packagist

Published Date 2022-09-30

Last Updated 2022-09-30

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2022-39261

To remediate this vulnerability, upgrade all affected Twig/twig dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

twig/twig fixed: 1.44.7

Upgrade twig/twig to 1.44.7

twig/twig fixed: 2.15.3

Upgrade twig/twig to 2.15.3

twig/twig fixed: 3.4.3

Upgrade twig/twig to 3.4.3

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for twig/twig

How to Check if You Are Affected

To determine whether your application is affected by CVE-2022-39261, inspect your project dependencies for Twig/twig:

inspect dependencies for twig/twig

Analyze the terminal output to locate any version of Twig/twig in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.44.7), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Twig/twig, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

# Description When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed). # Resolution We fixed validation for such template names. Even if the 1.x branch is not maintained anymore, a new version has been released. # Credits We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

CVE-2022-39261 Affected Twig/twig Versions

3 component(s)

Fixed Versions:

1.44.72.15.33.4.3

Product / Package	Ecosystem	Affected Versions	Fixed Version
twig/twig	Packagist	≥ 1.0.0 < 1.44.7	1.44.7
twig/twig	Packagist	≥ 2.0.0 < 2.15.3	2.15.3
twig/twig	Packagist	≥ 3.0.0 < 3.4.3	3.4.3

References

GitHub Advisory / Wiki ADVISORY

https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33

NVD — CVE-2022-39261 NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-39261

Security Fix Commit FIX COMMIT

https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b

Twig/twig Source Repository REPOSITORY

https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml

Twig/twig Source Repository REPOSITORY

https://github.com/twigphp/Twig

lists.debian.org/debian-lts-announce... WEB

https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD

lists.fedoraproject.org/archives/list/packa... WEB

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F

Twig/twig Release RELEASE

https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader

Twig/twig Security Information SECURITY

https://www.debian.org/security/2022/dsa-5248

www.drupal.org/sa-core-2022-016 WEB

https://www.drupal.org/sa-core-2022-016

Frequently Asked Questions

What is CVE-2022-39261?

CVE-2022-39261 is a security vulnerability in Twig/twig involving Twig may load a template outside a configured directory when using the filesystem loader under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

Which Twig/twig versions are affected?

Affected versions include releases prior to 1.44.7, 2.15.3, 3.4.3 across affected packages: twig/twig.

What version fixes CVE-2022-39261?

Upgrading to 1.44.7, 2.15.3, 3.4.3 (or the latest patched release for your respective branch) resolves the vulnerability.

Is twig/twig affected?

Yes, twig/twig is affected in releases prior to 1.44.7, 2.15.3, 3.4.3. Upgrade your dependency to 1.44.7, 2.15.3, 3.4.3 or later.

What is the CVSS score of CVE-2022-39261?

CVE-2022-39261 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2022-39261?

CVE-2022-39261 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).

How can I check Packagist dependencies for CVE-2022-39261?

Run the dependency tree command: 'inspect dependencies for twig/twig'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-52m2-vc4m-jj33",
  "modified" : "2022-09-30T05:29:36Z",
  "published" : "2022-09-30T05:29:36Z",
  "aliases" : [ "CVE-2022-39261" ],
  "summary" : "Twig may load a template outside a configured directory when using the filesystem loader",
  "details" : "# Description\n\nWhen using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).\n\n# Resolution\n\nWe fixed validation for such template names.\n\nEven if the 1.x branch is not maintained anymore, a new version has been released.\n\n# Credits\n\nWe would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "twig/twig"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.0.0"
      }, {
        "fixed" : "1.44.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "twig/twig"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0"
      }, {
        "fixed" : "2.15.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "twig/twig"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.4.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/twigphp/Twig/security/advisories/GHSA-52m2-vc4m-jj33"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-39261"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2022-39261.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/twigphp/Twig"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2022/10/msg00016.html"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2OKRUHPVLIQVFPPJ2UWC3WV3WQO763NR"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AUVTXMNPSZAHS3DWZEM56V5W4NPVR6L7"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NWRFPZSR74SYVJKBTKTMYUK36IJ3SQJP"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TW53TFJ6WWNXMUHOFACKATJTS7NIHVQE"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WV5TNNJLGG536TJH6DLCIAAZZIPV2GUD"
  }, {
    "type" : "WEB",
    "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU4ZYX62H2NUAKKGUES4RZIM4KMTKZ7F"
  }, {
    "type" : "WEB",
    "url" : "https://symfony.com/blog/twig-security-release-possibility-to-load-a-template-outside-a-configured-directory-when-using-the-filesystem-loader"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2022/dsa-5248"
  }, {
    "type" : "WEB",
    "url" : "https://www.drupal.org/sa-core-2022-016"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2022-09-30T05:29:36Z",
    "nvd_published_at" : "2022-09-28T14:15:00Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Advisory Metadata

Source ID: GHSA-52m2-vc4m-jj33
Schema Version: 1.4.0
Published: 2022-09-30 05:29
Last Modified: 2022-09-30 05:29
Database Record File: advisories/github-reviewed/2022/09/GHSA-52m2-vc4m-jj33/GHSA-52m2-vc4m-jj33.json