kritik
CVE-2026-24425
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass ...
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GHSA8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Ubuntu (orta).
Açıklama
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| composer::GitHub Security Advisory Composer | twig/twig | 3.26.0 |
| composer::PHP Security Advisories Database | twig/twig | düzeltme belirtilmemiş |
| debian 13 | php-twig | 3.27.0-0+deb13u1 |
| debian 14 | php-twig | 3.26.0-1 |
| rapidfort debian 12 | php-twig | 0:3.26.0-1, 0:3.27.0-0+deb13u1 |
| rapidfort debian 13 | php-twig | 0:3.26.0-1, 0:3.27.0-0+deb13u1 |
| rapidfort ubuntu 20.04 | php-twig | 0:3.26.0-1 |
| rapidfort ubuntu 22.04 | php-twig | 0:3.26.0-1 |
| rapidfort ubuntu 24.04 | php-twig | 0:3.26.0-1 |
| ubuntu 26.04 | php-twig | düzeltme belirtilmemiş |
Referanslar
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-24425.yaml
- https://github.com/twigphp/Twig
- https://github.com/twigphp/Twig/releases/tag/v3.26.0
- https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr
- https://nvd.nist.gov/vuln/detail/CVE-2026-24425
- https://symfony.com/blog/cve-2026-24425-possible-sandbox-bypass-when-using-a-source-policy
- https://symfony.com/cve-2026-24425
- https://ubuntu.com/security/notices/USN-8408-1