CVE-2024-51754
Fixed in a distro release EPSS <1%CVSS 2.2
Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
Products: twigphp Twig
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | twig/twig | 3.11.2 |
| Packagist | twig/twig | 3.14.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | php-twig | 2.14.3-1+deb11u4 |
| Debian 12 | php-twig | 3.5.1-1+deb12u3 |
| Debian 13 | php-twig | 3.14.2-1 |
| Debian 14 | php-twig | 3.14.2-1 |
| Ubuntu Pro 16.04 LTS | twig | no fix |
| Ubuntu Pro 18.04 LTS | twig | no fix |
| Ubuntu Pro 20.04 LTS | php-twig | 2.12.5-1ubuntu0.1~esm2 |
| Ubuntu Pro 22.04 LTS | php-twig | 3.3.8-2ubuntu4+esm2 |
| Ubuntu Pro 24.04 LTS | php-twig | 3.8.0-2ubuntu0.1~esm1 |