Description
The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | twig | 1.16.2-1+deb8u1 | DSA-3343-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | twig/twig | < 1.20.0 | 1.20.0 | GHSA-xw83-pwrm-9j74 |
Advisories 1
- DSA-3343-1 twig - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/twigphp/Twig/pull/1759
- DSA-3343 vendor-advisory
- http://symfony.com/blog/security-release-twig-1-20-0
- https://github.com/fabpot/Twig/commit/30be07759a3de2558da5224f127d052ecf492e8f
- [oss-security] 20151011 Re: CVE Request: twig remote code execution mailing-list
- [oss-security] 20150821 CVE Request: twig remote code execution mailing-list