---
title: "CVE-2022-39261"
canonical: "https://kb.cynergy.app/space/MD/922255361/CVE-2022-39261"
format: markdown
---
**Description**

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader loads templates for which the name is user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed. Versions 1.44.7, 2.15.3, and 3.4.3 contain a fix for the validation of such template names. There are no known workarounds aside from upgrading.

**Published On**

09/28/2022

**Updated On**

10/11/2022

**Trending**

FALSE

**CWE**

<u>[CWE-22](http://cwe.mitre.org/data/definitions/22.html)</u>


**Mitigation:**

![image](media://f7bae45d-87d8-41ae-9114-1debad2f32b6)

Cynergy has an automated mitigation capability that requires integration with your WAF provider.

Once integrated, you can request “Protect with WAF”

This will move the exposed asset behind WAF protection

<span style="color: #97a0af">**Note: **</span><span style="color: #97a0af">Policies configuration should be defined separately</span>


**Remediation**

Update based on the vendor recommendations:

Install the latest version of Drupal

- If you are using Drupal 9.4, update to [Drupal 9.4.7](https://www.drupal.org/project/drupal/releases/9.4.7).
- If you are using Drupal 9.3, update to [Drupal 9.3.22](https://www.drupal.org/project/drupal/releases/9.3.22).

All versions of Drupal 9 prior to 9.3.x are end-of-life and do not receive security coverage. Note that [Drupal 8 has reached its end of life](https://www.drupal.org/psa-2021-06-29).

Drupal 7 core does not include Twig and therefore is not affected.