CVE-2024-51755
Fixed in a distro release EPSS <1%CVSS 2.2
Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
Products: twigphp Twig
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | twig/twig | 3.11.2 |
| Packagist | twig/twig | 3.14.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | php-twig | no fix |
| Debian 13 | php-twig | 3.14.2-1 |
| Debian 14 | php-twig | 3.14.2-1 |
| Ubuntu Pro 16.04 LTS | twig | no fix |
| Ubuntu Pro 18.04 LTS | twig | no fix |
| Ubuntu Pro 20.04 LTS | php-twig | no fix |
| Ubuntu Pro 22.04 LTS | php-twig | no fix |
| Ubuntu Pro 24.04 LTS | php-twig | no fix |