CVE-2018-13818

CRITICAL 9.8CVE-2018-13818 · Published 10/07/2018 · updated 17/06/2026

In short

CVE-2018-13818 is a CRITICAL (CVSS 9.8) vulnerability affecting twig (symfony).
Chance of exploitation in the next 30 days (EPSS): 6.9%, higher than 94.1% of all vulnerabilities.
Fix: update to 2.4.4 or later.

Package	Affected versions	Patched versions
twig symfony	`< 2.4.4`	`2.4.4`

Description

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

References

twigphp/Twig · Release Notes
twigphp/Twig commit eddb971 · Patch
twigphp/Twig · Exploit
mobile.twitter.com/jameel_nabbo/status/1032593354704515072 · Exploit
exploit-db.com/exploits/44102 · Exploit

More vulnerabilities in twig

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

twig

symfony

< 2.4.4

2.4.4

More vulnerabilities in twig

See all →