CyberRota Analysis
AI-GeneratedVersions of Twig from 3.15.0 to 3.26.0 are vulnerable to a flaw that allows an attacker to inject and execute arbitrary PHP code through unvalidated dynamic attribute syntax in MacroReferenceExpressions. This can lead to remote code execution, posing a significant risk to applications utilizing affected versions of the template engine. Developers and organizations using Twig in their PHP applications should prioritize upgrading to version 3.26.0 or later to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)