CVE-2024-45411
Fixed in a distro release EPSS <1%CVSS 8.6
Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.
Products: twigphp Twig, symfony twig
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | twig/twig | 1.44.8 |
| Packagist | twig/twig | 2.16.1 |
| Packagist | twig/twig | 3.14.0 |
| Packagist | twig/twig | 3.11.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | php-twig | 2.14.3-1+deb11u3 |
| Debian 12 | php-twig | 3.5.1-1+deb12u1 |
| Debian 13 | php-twig | 3.8.0-4 |
| Debian 14 | php-twig | 3.8.0-4 |
| Ubuntu 24.04 LTS | php-twig | 3.8.0-2ubuntu1 |
| Ubuntu Pro 16.04 LTS | twig | no fix |
| Ubuntu Pro 18.04 LTS | twig | no fix |
| Ubuntu Pro 20.04 LTS | php-twig | no fix |
| Ubuntu Pro 20.04 LTS | php-twig | 2.12.5-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | php-twig | 3.3.8-2ubuntu4+esm2 |
| Ubuntu Pro 24.04 LTS | php-twig | 3.8.0-2ubuntu0.1~esm1 |