CVE-2024-45411

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 1.44.8 Twig versions prior to 2.16.1 Twig versions prior to 3.14.0

Description: Under some circumstances, the sandbox security checks are not run, which allows user-contributed templates to bypass the sandbox restrictions. This issue occurs when the sandbox is disabled globally, and a sandboxed include() function references a template name that has been loaded before in a non-sandbox context.

Recommendations: For versions prior to 1.44.8, update to version 1.44.8 or later. For versions prior to 2.16.1, update to version 2.16.1 or later. For versions prior to 3.14.0, update to version 3.14.0 or later. As a temporary workaround, consider enabling the sandbox security checks globally to prevent user-contributed templates from bypassing the sandbox restrictions.