Twig may load a template outside a configured directory when using the filesystem loader

Vulnerability

CVE-2022-39261 is a path traversal vulnerability in the Twig template engine for PHP, affecting versions 1.x before 1.44.7, 2.x before 2.15.3, and 3.x before 3.4.3. When the filesystem loader processes template names supplied as user input, validation of template paths is insufficient. An attacker can use a namespace syntax such as @somewhere/../some.file to bypass directory restrictions and read arbitrary files outside the intended templates directory [1][4].

Exploitation

The attack requires that the application passes untrusted user input directly as the template name to the filesystem loader. This can occur through source or include statements in Twig templates. The attacker does not need authentication if the application exposes template loading to unauthenticated users, although many deployments require some level of access to write or influence template names [1]. The vulnerability is particularly relevant in content management systems like Drupal, where administrative users with permission to write Twig code can trigger the path traversal [3].

Impact

Successful exploitation allows an attacker to read arbitrary files on the server, such as configuration files, source code, or database credentials. This information disclosure can lead to further compromise of the application or underlying system. The vulnerability is rated high severity due to the potential for sensitive data exposure [1][4].

Mitigation

Twig has released fixed versions: 1.44.7, 2.15.3, and 3.4.3 [1][4]. Drupal core users should update to Drupal 9.3.22 or 9.4.7, as Drupal uses Twig and issued a related security advisory (SA-CORE-2022-016) [3]. No workarounds exist other than upgrading. Users of the unsupported 1.x branch should upgrade to the patched 1.44.7 release [2].