{"id":"CVE-2024-45411","published":"2024-09-09T18:20:28Z","modified":"2024-09-16T12:04:18Z","title":"Twig has a possible sandbox bypass","vendor":"twigphp","product":"Twig","tier":"tail","description":{"text":"Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00849,"percentile":0.58119,"provenance":"source"},"cwes":[{"id":"CWE-693","name":"Protection Mechanism Failure"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6","tags":["x_refsource_MISC"]},{"url":"https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de","tags":["x_refsource_MISC"]},{"url":"https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00031.html","tags":[]}],"priority":{"score":17.6,"factors":[{"name":"EPSS percentile","points":11.62},{"name":"CVSS severity","points":6.02}]},"vendorSlug":"twigphp","affectedVersions":[{"vendor":"twigphp","product":"Twig","versions":["> 1.0.0, < 1.44.8","> 2.0.0, < 2.16.1","> 3.0.0, < 3.14.0"]}],"affected":[{"ecosystem":"Packagist","package":"twig/twig","vulnerableRanges":[">=1.0.0, <1.44.8",">=2.0.0, <2.16.1",">=3.12.0, <3.14.0",">=3.0.0, <3.11.1"],"patched":["1.44.8","2.16.1","3.14.0","3.11.1"],"from":["GHSA-6j75-5wfj-gh66"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2735","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-twigphp-twig-cve-2022-23614","parents":[{"from":"CVE-2022-23614","to":"CVE-2024-45411","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Extension/CoreExtension.php"],"commits":["https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6","https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2024-45411","to":"CVE-2024-51755","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:twig/twig","fromFixed":"3.11.1","toFixed":"3.11.2","daysApart":58},{"kind":"same-code","provenance":"machine","files":["src/Extension/CoreExtension.php"],"commits":["https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6","https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de","https://github.com/twigphp/Twig/commit/831c148e786178e5f2fde9db67266be3bf241c21"],"basis":"rarely changed file"}]},{"from":"CVE-2024-45411","to":"CVE-2026-46638","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-7fxw-r6jv-74c8","via":"reference","url":"https://github.com/advisories/GHSA-6j75-5wfj-gh66"}]}],"packageHistory":[{"cve":"CVE-2019-9942","published":"2019-03-23","fixed":"2.7.0","kev":false},{"cve":"CVE-2022-23614","published":"2022-02-04","fixed":"3.3.8","kev":false},{"cve":"CVE-2022-39261","published":"2022-09-28","fixed":"3.4.3","kev":false,"link":{"from":"CVE-2022-39261","to":"CVE-2024-45411","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:twig/twig","fromFixed":"1.44.7","toFixed":"1.44.8","daysApart":712},{"kind":"version-step","provenance":"source","package":"Packagist:twig/twig","fromFixed":"2.15.3","toFixed":"2.16.1","daysApart":712}]}},{"cve":"CVE-2024-45411","published":"2024-09-09","fixed":"3.14.0","kev":false},{"cve":"CVE-2024-51754","published":"2024-11-06","fixed":"3.14.1","kev":false,"link":{"from":"CVE-2024-45411","to":"CVE-2024-51754","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:twig/twig","fromFixed":"3.11.1","toFixed":"3.11.2","daysApart":58}]}},{"cve":"CVE-2024-51755","published":"2024-11-06","fixed":"3.14.1","kev":false},{"cve":"CVE-2025-24374","published":"2025-01-29","fixed":"3.19.0","kev":false}],"package":"Packagist:twig/twig"}}