Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2018-13818

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2018-13818
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 10:16 UTC · Revision 1

Source evidence

CVE-2018-13818

core-osv · Original source

Published 10 Jul 2018, 14:29 UTC

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

osv:CVE-2018-13818
Complete source record
{
  "id": "951d95588af27e9c1461e557b99b860a42dac93670ad2fda7072e352d227fe82",
  "url": "https://osv.dev/vulnerability/CVE-2018-13818",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2018-13818",
    "summary": "Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it",
    "evidence": "osv:CVE-2018-13818",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2018-13818",
      "aliases": [
        "CVE-2018-13818"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/twigphp/twig",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "eddb97148ad779f27e670e1e3f19fb323aedafeb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.4.4"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "eddb97148ad779f27e670e1e3f19fb323aedafeb"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.18.0",
            "v1.17.0",
            "v1.16.3",
            "v1.16.2",
            "v1.16.1",
            "v1.16.0",
            "v1.15.1",
            "v1.15.0",
            "v1.14.2",
            "v1.14.1",
            "v1.14.0",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.3",
            "v1.12.2",
            "v1.12.1",
            "v1.12.0",
            "v1.12.0-RC1",
            "v1.11.1",
            "v1.11.0",
            "v1.10.3",
            "v1.10.2",
            "v1.10.1",
            "v1.10.0",
            "v1.9.2",
            "v1.9.1",
            "v1.9.0",
            "v1.8.3",
            "v1.8.2",
            "v1.8.1",
            "v1.8.0",
            "v1.7.0",
            "v1.6.4",
            "v1.6.3",
            "v1.6.2",
            "v1.6.1",
            "v1.5.1",
            "v1.6.0",
            "v1.5.0",
            "v1.5.0-RC2",
            "v1.5.0-RC1",
            "v1.4.0",
            "v1.4.0-RC2",
            "v1.4.0-RC1",
            "v1.3.0",
            "v1.3.0-RC1",
            "v1.2.0",
            "v1.2.0-RC1",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.1.0-RC3",
            "v1.1.0-RC2",
            "v1.1.0-RC1",
            "v1.0.0",
            "v1.0.0-RC2",
            "v1.0.0-RC1",
            "v0.9.10",
            "v0.9.9",
            "v0.9.8",
            "v0.9.7",
            "v0.9.6",
            "v0.9.5",
            "v0.9.4",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-13818.json"
          }
        }
      ],
      "modified": "2026-10-20T10:50:02.416338892Z",
      "provider": "osv",
      "references": [
        "https://github.com/twigphp/Twig/blob/2.x/CHANGELOG",
        "https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb",
        "https://github.com/twigphp/Twig/issues/2743",
        "https://mobile.twitter.com/jameel_nabbo/status/1032593354704515072?s=20",
        "https://www.exploit-db.com/exploits/44102/"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2018-13818",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 381178,
  "published_at": "2018-07-10T14:29:00.48+00:00"
}