Nicolas Grekas

**Name of the Vulnerable Software and Affected Versions** Twig versions 1.x prior to 1.44.7 Twig versions 2.x prior to 2.15.3 Twig versions 3.x prior to 3.4.3 **Description** The issue arises when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. **Recommendations** For versions 1.x prior to 1.44.7, update to version 1.44.7 or later. For versions 2.x prior to 2.15.3, update to version 2.15.3 or later. For versions 3.x prior to 3.4.3, update to version 3.4.3 or later. As a temporary workaround, consider restricting the use of the `source` and `include` statements with user-input template names until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Symfony versions prior to 2.7.51 Symfony versions 2.8.x prior to 2.8.50 Symfony versions 3.x prior to 3.4.26 Symfony versions 4.x prior to 4.1.12 Symfony versions 4.2.x prior to 4.2.7 **Description** The issue is related to the symfony/dependency-injection component and occurs when service ids allow user input. This could allow for SQL Injection and remote code execution due to a lack of protection measures for SQL query structures. **Recommendations** For Symfony versions prior to 2.7.51, update to version 2.7.51 or later. For Symfony versions 2.8.x prior to 2.8.50, update to version 2.8.50 or later. For Symfony versions 3.x prior to 3.4.26, update to version 3.4.26 or later. For Symfony versions 4.x prior to 4.1.12, update to version 4.1.12 or later. For Symfony versions 4.2.x prior to 4.2.7, update to version 4.2.7 or later.