Skip to content
OpenAdvisories
High USN-7549-1 1 CVE

php-twig vulnerability

Published Jun 2, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Twig did not correctly handle securing
user input. An attacker could possibly use this issue to cause
Twig to expose sensitive information if it opened a specially
crafted file. (CVE-2024-45411)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS php-twig 3.8.0-2ubuntu1

Vulnerabilities 1

  • High 8.6
    CVE-2024-45411

    Twig has a possible sandbox bypass

    Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

    twigphp Twig php-twig php-twig Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2024-45411