CVE-2022-39261

score

<0.1

cvss

7.5

epss

3.2%

published

2022-09-28

kev added

—

first seen

2026-10-21

Twig versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 contain a path traversal caused by improper validation of user input in template names when using filesystem loader with namespaces, letting attackers read arbitrary files outside the templates directory, exploit requires attacker to control template name input.