CVE-2024-45411: Symfony Twig

High severity, CVSS 8.6. EPSS: 0.8% chance of exploitation in the next 30 days.

Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions. This vulnerability is fixed in 1.44.8, 2.16.1, and 3.14.0.

Affected products

• Symfony Twig: from 1.0.0, before 1.44.8 (fixed in 1.44.8); from 2.0.0, before 2.16.1 (fixed in 2.16.1); from 3.0.0, before 3.14.0 (fixed in 3.14.0)

Published 2024-09-09. Last modified 2026-06-17.