https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 09:50:36 +0000 https://cve.radiocsirt.org/vuln/bit-drupal-2022-39261 <p><strong>Affected:</strong> Bitnami: drupal</p> <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> <p><strong>Affected:</strong> Bitnami: drupal</p> <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> https://cve.radiocsirt.org/vuln/bit-drupal-2022-39261 https://cve.radiocsirt.org/vuln/certfr-2022-avi-866 certfr-2022-avi-866 https://cve.radiocsirt.org/vuln/certfr-2022-avi-866 https://cve.radiocsirt.org/vuln/cnvd-2022-88789 cnvd-2022-88789 https://cve.radiocsirt.org/vuln/cnvd-2022-88789 https://cve.radiocsirt.org/vuln/euvd-2026-233563 EUVD-2026-233563 https://cve.radiocsirt.org/vuln/euvd-2026-233563 https://cve.radiocsirt.org/vuln/fkie_cve-2022-39261 <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-39261 https://cve.radiocsirt.org/vuln/ghsa-52m2-vc4m-jj33 <p><strong>Affected:</strong> Packagist: twig/twig</p> <p># Description</p> <p>When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).</p> <p># Resolution</p> <p>We fixed validation for such template names.</p> <p>Even if the 1.x branch is not maintained anymore, a new version has been released.</p> <p># Credits</p> <p>We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.</p> <p><strong>Affected:</strong> Packagist: twig/twig</p> <p># Description</p> <p>When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed).</p> <p># Resolution</p> <p>We fixed validation for such template names.</p> <p>Even if the 1.x branch is not maintained anymore, a new version has been released.</p> <p># Credits</p> <p>We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-52m2-vc4m-jj33 https://cve.radiocsirt.org/vuln/gsd-2022-39261 gsd-2022-39261 https://cve.radiocsirt.org/vuln/gsd-2022-39261 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-39261 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: twig, Ubuntu:Pro:18.04:LTS: twig, Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig</p> <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: twig, Ubuntu:Pro:18.04:LTS: twig, Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig</p> <p>Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates&#39; directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-39261