CVE-2022-23614: debian debian_linux Injection
Vulnerability summary
CVE-2022-23614 is a critical (CVSS 9.8) Injection vulnerability in debian debian_linux. EPSS estimates a 8.21% chance of exploitation in the next 30 days, higher than 94.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 04-02-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
8.21%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Debian2 products
- php-twig< 2.14.3-1+deb11u1 | < 3.3.8-1
- debian_linuxEOL11.0
Fedoraproject1 product
- fedoraEOL34 | 35
Symfony1 product
- twig≥ 2.0.0, < 2.14.11 | ≥ 3.0.0, < 3.3.8
Twigphp1 product
- twig≥ 3.0.0, < 3.3.8 | ≥ 2.0.0, < 2.14.11
Ubuntu1 product
- php-twig< 2.12.5-1ubuntu0.1~esm1
5 vendors · 6 products
References
12 links- github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2vX Refsource CONFIRMREPORTThird Party Advisory
- github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9X Refsource MISCREPORTPatchThird Party Advisory
- github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5X Refsource MISCREPORTPatchThird Party Advisory
