CVE-2018-13818

⛔ critical

Summary

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it

CVSS Score

9.8

Critical

EPSS Score

0.5

Exploit Probability

Published Date

2018-07-10

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Very High Risk - more severe than 90.5% of all 330,193 vulnerabilities in our database.

#31,351

Top 10% most severe

Severity Percentile

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-94

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
symfony	twig	Affected	< 2.4.4

🔗 References 5

https://github.com/twigphp/Twig/blob/2.x/CHANGELOG

Release Notes

https://github.com/twigphp/Twig/commit/eddb97148ad77...

Patch Third Party Advisory

https://github.com/twigphp/Twig/issues/2743

Exploit Third Party Advisory

https://mobile.twitter.com/jameel_nabbo/status/10325...

Exploit Third Party Advisory

https://www.exploit-db.com/exploits/44102/

Exploit Third Party Advisory VDB Entry

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-24425	⚠️ high	8.8	0.1	Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface ...	2026-05-20
CVE-2024-45411	⚠️ high	8.5	0.1	Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user...	2024-09-09
CVE-2022-39261	⚠️ high	7.5	2.3	Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter...	2022-09-28
CVE-2022-23614	⚠️ high	8.8	34.9	Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter mus...	2022-02-04
CVE-2019-9942	ℹ️ low	3.7	0.3	A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it...	2019-03-23
CVE-2015-7809	🔶 medium	6.8	2.0	The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote at...	2015-11-06

These CVEs affect the same products