https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 10:53:55 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-03019 bdu:2022-03019 https://cve.radiocsirt.org/vuln/bdu:2022-03019 https://cve.radiocsirt.org/vuln/cnvd-2022-11212 cnvd-2022-11212 https://cve.radiocsirt.org/vuln/cnvd-2022-11212 https://cve.radiocsirt.org/vuln/euvd-2026-234481 EUVD-2026-234481 https://cve.radiocsirt.org/vuln/euvd-2026-234481 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23614 <p>Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.</p> <p>Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-23614 https://cve.radiocsirt.org/vuln/ghsa-5mv2-rx3q-4w2v <p><strong>Affected:</strong> Packagist: twig/twig</p> <p># Description</p> <p>When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.</p> <p># Resolution</p> <p>We now disallow calling non Closure in the `sort` filter like we already did for some other filters.</p> <p># Credits</p> <p>We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.</p> <p><strong>Affected:</strong> Packagist: twig/twig</p> <p># Description</p> <p>When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.</p> <p># Resolution</p> <p>We now disallow calling non Closure in the `sort` filter like we already did for some other filters.</p> <p># Credits</p> <p>We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.</p> https://cve.radiocsirt.org/vuln/ghsa-5mv2-rx3q-4w2v https://cve.radiocsirt.org/vuln/gsd-2022-23614 gsd-2022-23614 https://cve.radiocsirt.org/vuln/gsd-2022-23614 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23614 <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: php-twig</p> <p>Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.</p> <p><strong>Affected:</strong> Ubuntu:Pro:20.04:LTS: php-twig</p> <p>Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-23614