CVE-2024-45411: Twig has a possible sandbox bypass

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-09 · updated 2026-06-17
Weakness: CWE-693

Description

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

Affected products

twigphp Twig: from 1.0.0 before 1.44.8; from 2.0.0 before 2.16.1; from 3.0.0 before 3.14.0 — fixed in 1.44.8, 2.16.1, 3.14.0

How to fix

Upgrade to a fixed version: twigphp Twig 1.44.8, 2.16.1, 3.14.0. Check the vendor advisory for mitigations.

References

https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6
https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de
https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233
https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66
https://lists.debian.org/debian-lts-announce/2024/09/msg00031.html

Get alerted when CVE-2024-45411 or the next vulnerability affects your stack