CVE-2024-45411CWE-693

Twig has a possible sandbox bypass

High · published September 9, 2024

CVSS v3.1
8.6
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00849 · 57.7th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2024-09-09T18:20Z
EPSS history
Timeline
  • 09 SEP 18:20Z
    Twig has a possible sandbox bypass
    cvelistv5