Description
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cakephp | twig-view | < 1.3.3, >= 2.0.0, < 2.1.2 | — |