StackRadarChart IndexLive demo

CVE-2022-39261

High

Advisory

Published 28 Sept 2022In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.026; 84th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 71; of 17,781 indexed, latest versions
Container images: 60; deployed by those charts
Fix available: 2 of 2; affected packages

Twig may load a template outside a configured directory when using the filesystem loader

Carried by container images the latest versions of 71 of 17,781 indexed charts deploy, on 60 images.

Affected package	Affected versions	Fixed in	Images
twig/twigcomposer	v1.35.0, v1.35.3, v1.42.5, v2.5.0+9 more	1.44.7, 2.15.3, 3.4.3	60
drupal/corecomposer	8.9.20	9.3.22	1

OSV records: GHSA-52m2-vc4m-jj33 DRUPAL-CORE-2022-016
Also known as: BIT-drupal-2022-39261

Charts affected

71 by stars

Chart

Latest

Affected images

Radar Score

orderregistratiecomponentorderregistratiecomponent

1 of 3 See more

orderregistratiecomponent orderregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,492

firefly-iiiphntom

1 of 2 See more

firefly-iii phntom 0.2.10

1 of the 2 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
phntom/fireflyiii :version-5.7.5	f881ea5fbbf1	twig/twig@v3.3.10	3.4.3

Open the chart page →

1,813

procestypecatalogusprocestypecatalogus

1 of 4 See more

procestypecatalogus procestypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/procestypecatalogus-php :latest	956c4fb64796	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,429

productenendienstencatalogusproductenendienstencatalogus

1 of 3 See more

productenendienstencatalogus productenendienstencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,510

panproto-application-nldesign

1 of 5 See more

pan proto-application-nldesign 0.1.0

1 of the 5 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
conduction/pan-php :dev	24f03c57568f	twig/twig@v2.13.1	2.15.3

Open the chart page →

8,725

proto-component-commongroundproto-component-commonground

1 of 3 See more

proto-component-commonground proto-component-commonground 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,510

review-componentreview-component

1 of 3 See more

review-component review-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,491

1 of 6 See more

shopware robjuz 2.0.0

1 of the 6 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
shyim/shopware :6.4.6.0	a951c0e6b836	twig/twig@v3.3.3	3.4.3

Open the chart page →

2,972

mauticromholdings

1 of 3 See more

mautic romholdings 0.1.3

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
mautic/mautic :2.13-apache	a954c5868d76	twig/twig@v1.35.0	1.44.7

Open the chart page →

2,939

cachetsergiotocalini

1 of 1 See more

cachet sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
cachethq/docker :2.3.15	a61ff0f67ea7	twig/twig@v1.35.3	1.44.7

Open the chart page →

1,896

phpmyadminsitepilot

1 of 1 See more

phpmyadmin sitepilot 1.0.1

1 of the 1 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
phpmyadmin/phpmyadmin :5.1	38437e021deb	twig/twig@v2.14.13	2.15.3

Open the chart page →

1,724

taalhuizen-servicetaalhuizen-service

1 of 3 See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,480

repmanteam-blue

1 of 5 See more

repman team-blue 0.3.0

1 of the 5 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
buddy/repman :1.4.0	097c897f8b54	twig/twig@v3.3.7	3.4.3

Open the chart page →

3,993

trouw-servicetrouw-service

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,510

verhuis-serviceverhuis-service

1 of 3 See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,510

verzoekconversieserviceverzoekconversieservice

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,528

verzoekregistratiecomponentverzoekregistratiecomponent

1 of 4 See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,429

verzoektypecatalogusverzoektypecatalogus

1 of 4 See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	twig/twig@v2.13.1	2.15.3

Open the chart page →

7,429

webresourcecataloguswebresourcecatalogus

1 of 4 See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	twig/twig@v3.3.10	3.4.3

Open the chart page →

7,552

default-backendwyrihaximusnet

1 of 1 See more

default-backend wyrihaximusnet 1.1.0

1 of the 1 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
ghcr.io/wyrihaximusnet/default-backend :random	b24e63efd841	twig/twig@v3.3.3	3.4.3

Open the chart page →

2,534

1 of 1 See more

satisfy ymrs 1.0.2

1 of the 1 container images this version deploys carry CVE-2022-39261.

Container image	Digest	Package	Fixed in
anapsix/satisfydigest-pinned	fae78e3809e9	twig/twig@v2.5.0	2.15.3

Open the chart page →

1,572

Container images carrying it

60 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/verzoekregistratiecomponent-php :latest	c4f6c03af5d3	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/verzoektypecatalogus-php :latest	64f5eb7a398b	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/waardepapieren-php :latest	b2666ffcbad8	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/waardepapieren-register-php :latest	9affab218351	twig/twig@v2.13.1	2.15.3	1
ghcr.io/conductionnl/webresourcecatalogus-php :latest	8f1bbd5cda85	twig/twig@v3.3.10	3.4.3	1
ghcr.io/wyrihaximusnet/default-backend :random	b24e63efd841	twig/twig@v3.3.3	3.4.3	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	twig/twig@v3.3.10	3.4.3	1