CyberRota Analysis
AI-GeneratedThe Twig template language for PHP is vulnerable to a security bypass in versions prior to 3.26.0, where the {% sandbox %}{% include %} directive can inadvertently include previously loaded templates without proper security checks. This flaw allows potentially unsafe tags, filters, and functions to be executed, undermining the intended security policies. Developers and organizations utilizing Twig in their PHP applications should prioritize upgrading to version 3.26.0 to mitigate the risk of unauthorized code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)