Symfony Twig

Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

Code injection in Twig

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

Twig: PHP code injection via `{% use %}` template name

Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Twig has a possible sandbox bypass

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Twig may load a template outside a configured directory when using the filesystem loader

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

Twig: Sandbox property and method bypass via object-destructuring assignment

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.

Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

Twig: The `spaceless` filter implicitly marks its output as safe

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.