HighGHSA-52m2-vc4m-jj33BIT-drupal-2022-39261CVE-2022-39261DRUPAL-CORE-2022-016

Twig may load a template outside a configured directory when using the filesystem loader

Published 30 Sept 2022 · Updated 10 Dec 2025

Affected packages

twig/twigComposer

Affected: >=1.0.0 <1.44.7
Fixed in: 1.44.7

Update to the fixed version for your release line, for example:composer require twig/twig:^1.44.7

twig/twigComposer

Affected: >=2.0.0 <2.15.3
Fixed in: 2.15.3

Update to the fixed version for your release line, for example:composer require twig/twig:^2.15.3

twig/twigComposer

Affected: >=3.0.0 <3.4.3
Fixed in: 3.4.3

Update to the fixed version for your release line, for example:composer require twig/twig:^3.4.3

Details

Description

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namespace like @somewhere/../some.file (in such a case, validation is bypassed).

Resolution

We fixed validation for such template names.

Even if the 1.x branch is not maintained anymore, a new version has been released.

Credits

We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.

Is GHSA-52m2-vc4m-jj33 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected twig/twig, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.