CVE-2024-45411

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
09/09/2024
Last modified:
19/09/2024

Description

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* 1.0.0 (including) 1.44.8 (excluding)
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* 2.0.0 (including) 2.16.1 (excluding)
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* 3.0.0 (including) 3.14.0 (excluding)