https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T14:57:44.991200+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-drupal-2022-39261 BIT-drupal-2022-39261 — Twig may load a template outside a configured directory when using the filesystem loader 2026-10-20T14:57:44.995785+00:00

Affected: Bitnami: drupal

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.

 https://cve.radiocsirt.org/vuln/certfr-2022-avi-866 certfr-2022-avi-866 — Une vulnérabilité a été découverte dans Drupal core. Elle permet à un attaquant de provoquer un contournement de la pol… 2026-10-20T14:57:44.995835+00:00 certfr-2022-avi-866 https://cve.radiocsirt.org/vuln/cnvd-2022-88789 cnvd-2022-88789 2026-10-20T14:57:44.995855+00:00 cnvd-2022-88789 https://cve.radiocsirt.org/vuln/euvd-2026-233563 EUVD-2026-233563 2026-10-20T14:57:44.995868+00:00 EUVD-2026-233563 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39261 fkie_cve-2022-39261 2026-10-20T14:57:44.995879+00:00

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.

 https://cve.radiocsirt.org/vuln/ghsa-52m2-vc4m-jj33 GHSA-52m2-vc4m-jj33 — Twig may load a template outside a configured directory when using the filesystem loader 2026-10-20T14:57:44.995901+00:00

Affected: Packagist: twig/twig

# Description

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).

# Resolution

We fixed validation for such template names.

Even if the 1.x branch is not maintained anymore, a new version has been released.

# Credits

We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

 https://cve.radiocsirt.org/vuln/gsd-2022-39261 gsd-2022-39261 2026-10-20T14:57:44.995929+00:00 gsd-2022-39261 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-39261 UBUNTU-CVE-2022-39261 2026-10-20T14:57:44.995940+00:00

Affected: Ubuntu:Pro:16.04:LTS: twig, Ubuntu:Pro:18.04:LTS: twig, Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.