Twig security release: Possibility to load a template outside a configured directory when using the filesystem loader

Affected versions

Twig >1.0.0,1.44.7 || >2.0.0,2.15.3 || >3.0.0,3.4.3 are affected by this security issue.

The issue has been fixed in Twig 1.44.7, 2.15.3 and 3.4.3.

Description

When using the filesystem loader to load templates for which the name is a user input, it is possible to use the source or include statement to read arbitrary files from outside the templates directory when using a namesp

2y | Symfony
A Week of Symfony #821 (19-25 September 2022)

This week, Symfony development activity focused on finishing and polishing some new features for the upcoming Symfony 6.2 version, such us: updating codebase to use modern PHP features like null coalescing assignment and match statements; adding

2y | Symfony
SymfonyCon Disneyland Paris 2022: Focus on workshops!

SymfonyCon Disneyland Paris 2022 SymfonyCon Disneyland Paris 2022 is only 2 months away!

The conference will start with 2 days of workshops organized on November 15-16 at the Disney's Newport Ba

2y | Symfony
SymfonyCon Disneyland Paris 2022: All you need to know about transportation!

SymfonyCon Disneyland Paris 2022

SymfonyCon Disneyland Paris 2022 is around the corner! The conference will start in less than 2 months from November 15 to 16 at the Disney's Newport Bay Club for the workshops a

2y | Symfony
SymfonyCon Disneyland Paris 2022: All you need to know about catering!

SymfonyCon Disneyland Paris 2022

As SymfonyCon Disneyland Paris 2022 approaches, which will take place from November 15 to 16 at the Disney's Newport Bay Club and from November 17 to 18 at the Disney's Hotel New

2y | Symfony
SymfonyCon Disneyland Paris 2022: Schrödinger's SQL - The SQL inside the Doctrine box

SymfonyCon Disneyland Paris 2022

SymfonyCon Disneyland Paris 2022 will start in less than 2 months!

As this event approaches we are pleased to announce you the next person joining the sp

2y | Symfony
Sponsor SymfonyCon Disneyland Paris 2022

Sentry, Twilio, JetBrains PhpStorm, SensioLabs, NetGen Layouts, Les-Tilleuls.coop, … and other fantastic partners will join us at our big next event: SymfonyCon Disneyland Paris 2022!

Want to support us? Are you looking for great Symfony developers?

Join us and become a sponsor of the Sy

2y | Symfony
A Week of Symfony #820 (12-18 September 2022)

This week, development activity focused on tweaking and finishing some of the new features of Symfony 6.2, to be released at the end of November 2022. In addition to a new ChainUserChecker that allows calling multiple user checkers for a firewall, we merged the Sy

2y | Symfony
SymfonyCon Disneyland Paris 2022: The Evolution of Symfony: Now and to the Future!

SymfonyCon Disneyland Paris 2022

As this event approaches we are pleased to announce you the next person joining the speaker team:

Ryan We

2y | Symfony

Membri



Ricerca