Loading...
Skip to main content
GeekWala

CVE-2024-45411 — Vulnerability in twig/twig — CVE Details

MEDIUM

Twig has a possible sandbox bypass

Published September 9, 2024Updated October 10, 2024Source: osv

Summary

### Description Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. The security issue happens when all these conditions are met: * The sandbox is disabled globally; * The sandbox is enabled via a sandboxed `include()` function which references a template name (like `included.twig`) and not a `Template` or `TemplateWrapper` instance; * The included template has been loaded before the `include()` call but in a non-sandbox context (possible as the sandbox has been globally disabled). ### Resolution The patch ensures that the sandbox security checks are always run at runtime. ### Credits We would like to thank Fabien Potencier for reporting and fixing the issue.

Advisory Timeline

  • First published September 9, 2024 (763 days ago).
  • Last revised October 10, 2024 — 31 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer
Update twig/twig to 1.44.8 or later
composer require "twig/twig:^1.44.8"
Composer
Update twig/twig to 3.14.0 or later
composer require "twig/twig:^3.14.0"
Composer
Update twig/twig to 3.11.1 or later
composer require "twig/twig:^3.11.1"
Composer
Update twig/twig to 2.16.1 or later
composer require "twig/twig:^2.16.1"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: packagist (1).

PackageEcosystemAffectedFixed In
twig/twig
packagist
1.3.0, 1.4.0, 1.5.0, 1.5.1 (+110 more)1.44.8
twig/twig
packagist
v3.12.0, v3.13.03.14.0
twig/twig
packagist
v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+36 more)3.11.1
twig/twig
packagist
v2.0.0, v2.1.0, v2.10.0, v2.11.0 (+58 more)2.16.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-693
    Protection Mechanism FailureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-45411?
Twig has a possible sandbox bypass This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.5/10).
How do I check if my project is affected by CVE-2024-45411?
CVE-2024-45411 affects twig/twig. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-45411 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-6j75-5wfj-gh66

Related CVEs

  • CVE-2026-46633
    CRITICAL

    Twig: PHP code injection via `{% use %}` template name

  • CVE-2026-24425
    HIGH

    Twig: Possible sandbox bypass when using a source policy

  • CVE-2026-46640
    HIGH

    Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

  • CVE-2026-46639
    HIGH

    Twig: Sandbox property and method bypass via object-destructuring assignment

  • CVE-2026-75592
    MEDIUM

    Kirby: Access to image files outside of the site root via path traversal in the media handling

  • CVE-2026-46638
    MEDIUM

    Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

  • CVE-2026-88023
    MEDIUM

    MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies