CVE-2026-46633: Twig: kod enjeksiyonu

Açıklama (NVD)

Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

Özet bilgiler

Ürün

Symfony Twig

CVSS v3.1

9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v4.0

8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,77 (yüzdelik 56)

CWE

CWE-94

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• gist.github.com
• github.com
• github.com
• github.com
• github.com
• github.com
• github.com
• symfony.com
• CWE-94