CVE-2022-39261

Deeper analysis

Twig is a template engine for PHP whose filesystem loader is vulnerable to path traversal in versions 1.x before 1.44.7, 2.x before 2.15.3, and 3.x before 3.4.3. When a template name supplied as user input is resolved through a namespace reference, the loader fails to enforce directory restrictions, allowing statements such as source or include to reference files outside the intended template root via sequences like @somewhere/../some.file. The flaw is classified as CWE-22 with a CVSS 3.1 score of 7.5 reflecting network-reachable confidentiality impact without authentication.

An unauthenticated remote attacker who can control template names passed to the filesystem loader can read arbitrary files on the server filesystem. Successful exploitation requires only that the application uses Twig’s namespace-based loading with untrusted input; no other privileges or user interaction are needed.

The GitHub security advisory and accompanying commit, along with distribution lists from Debian and Fedora, state that the only remediation is to upgrade to Twig 1.44.7, 2.15.3, or 3.4.3; no configuration workarounds are documented. The EPSS score has remained flat at 0.0950 since disclosure, indicating no material increase in observed exploitation interest.