{"schemaVersion":3,"id":"CVE-2022-23614","aliases":["UBUNTU-CVE-2022-23614","DEBIAN-CVE-2022-23614","DSA-5107-1"],"status":"published","duplicateOf":null,"title":null,"description":"Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.","dates":{"published":"2022-02-04T22:25:11.000Z","modified":"2025-04-23T19:08:27.990Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08209,"percentile":0.94864,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.08209},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08209,"percentile":0.94864}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.08209,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.08209,"percentile":0.94864}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')","description":"The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/74.html"},{"id":"CWE-94","name":"Improper Control of Generation of Code ('Code Injection')","description":"The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/94.html"}],"affected":[{"vendor":"debian","product":"php-twig","name":"php-twig","label":"php-twig","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/php-twig","purlType":"deb","versions":[{"text":"< 2.14.3-1+deb11u1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.3.8-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.14.3-1+deb11u1 | < 3.3.8-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"php-twig","name":"php-twig","label":"php-twig","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/php-twig","purlType":"deb","versions":[{"text":"< 2.12.5-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.12.5-1ubuntu0.1~esm1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.0","eol":{"isEol":true,"eolDate":"2026-08-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11","label":"11 (Bullseye)","eolFrom":"2026-08-31T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"11.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"34","noFixRecorded":false,"fixedIn":null},{"text":"35","noFixRecorded":false,"fixedIn":null}],"versionsText":"34 | 35","eol":{"isEol":true,"eolDate":"2022-06-07T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"34","label":"34","eolFrom":"2022-06-07T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"symfony","product":"twig","name":"twig","label":"twig","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 2.0.0, < 2.14.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 3.0.0, < 3.3.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 2.0.0, < 2.14.11 | ≥ 3.0.0, < 3.3.8","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"twig","label":"Twig","category":"framework"}},"hubHref":"/vendor/symfony/twig"},{"vendor":"twigphp","product":"twig","name":"Twig","label":"twig","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 3.0.0, < 3.3.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, < 2.14.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 3.0.0, < 3.3.8 | ≥ 2.0.0, < 2.14.11","eol":{"isEol":null,"eolDate":null,"matchMethod":"name_exact","cycle":null,"product":{"name":"twig","label":"Twig","category":"framework"}},"hubHref":"/vendor/twigphp/twig"}],"affectedCount":6,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v","label":"github.com/twigphp/Twig/security/advisories/GHSA-5mv2-rx3q-4w2v","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Third Party Advisory"]},{"url":"https://github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","label":"github.com/twigphp/Twig/commit/22b9dc3c03ee66d7e21d9ed2ca76052b134cb9e9","hostname":"github.com","tags":["X Refsource MISC","REPORT","Patch","Third Party Advisory"]},{"url":"https://github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","label":"github.com/twigphp/Twig/commit/2eb33080558611201b55079d07ac88f207b466d5","hostname":"github.com","tags":["X Refsource MISC","REPORT","Patch","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OTN4273U4RHVIXED64T7DSMJ3VYTPRE7/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PECHIY2XLWUH2WLCNPDGNFMPHPRPCEDZ/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I2PVV5DUTRUECTIHMTWRI5Z7DVNYQ2YO/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIGZCFSYLPP7UVJ4E4NLHSOQSKYNXSAD/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://www.debian.org/security/2022/dsa-5107","label":"www.debian.org/security/2022/dsa-5107","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23614","label":"ubuntu.com/security/CVE-2022-23614","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-5947-1","label":"ubuntu.com/security/notices/USN-5947-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23614","label":"www.cve.org/CVERecord?id=CVE-2022-23614","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23614","label":"security-tracker.debian.org/tracker/CVE-2022-23614","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["USN-5947-1"],"duplicates":[],"related":["USN-5947-1"]},"timeline":[{"kind":"published","date":"2022-02-04T22:25:11.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-04-23T19:08:27.990Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T14:28:36.226Z","stale":false,"partial":false}}