tocsin

CVE-2022-39261

2 advisories.

Packagist/drupal/core CVE-2022-39261: unknown, EPSS 3.17%

Drupal uses the [Twig](https://twig.symfony.com/) third-party library for content templating and sanitization. [Twig has released a security update](https://symfony.com/blog/twig-security-release-poss

Action: Upgrade drupal/core to 9.3.22 or later.

composer require drupal/core:9.3.22
composer require drupal/core:9.4.7

Affected

introducedfixedlast affected
8.0.09.3.22-
9.4.09.4.7-

Fixed versions

9.3.229.4.7

Sources

CVE-2022-39261 · published · modified · JSON

Packagist/twig/twig CVE-2022-39261: high 7.5, EPSS 3.17%

Twig may load a template outside a configured directory when using the filesystem loader

Action: Upgrade twig/twig to 1.44.7 or later.

composer require twig/twig:1.44.7
composer require twig/twig:2.15.3
composer require twig/twig:3.4.3

Affected

introducedfixedlast affected
1.0.01.44.7-
2.0.02.15.3-
3.0.03.4.3-

Fixed versions

1.44.72.15.33.4.3

Sources

CVE-2022-39261 · published · modified · JSON