CVE-2022-39261 - CVE House

Back to Database

Status published High CVE-2022-39261

Twig may load a template outside a configured directory when using the filesystem loader

7.5 CVSS

Vulnerability Description

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for validation of such template names. There are no known workarounds aside from upgrading.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39261

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from twigphp

View All →

Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

Unguarded calls to __toString() when nesting an object into an array in Twig

Twig has a possible sandbox bypass

Code injection in Twig

Affected Vendor

twigphp

View all reports →

Affected Software

Twig

Vulnerable Versions:

=> 1.0.0, < 1.44.7, >= 2.0.0, < 2.15.3, >= 3.0.0, < 3.4.3

Timeline

Official Publish: September 28th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation