CVE-2022-23614

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions. In affected versions this constraint was not properly enforced and could lead to code injection of arbitrary PHP code. Patched versions now disallow calling non Closure in the `sort` filter as is the case for some other filters. Users are advised to upgrade.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Feb 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-236155.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236168.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2022-236176.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236186.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is no prCVE-2022-236197.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible CVE-2022-23627.5The Download Manager WordPress plugin before 3.2.50 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, whiCVE-2022-236205.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExpoCVE-2022-236214.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2022-236226.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a croCVE-2022-236238.8Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integration with class-validaCVE-2022-236248.8Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 aCVE-2022-236256.5Wire-ios is a messaging application using the wire protocol on apple's ios platform. In versions prior to 3.95 malformed resource identifier
CVE-2022-23614: Critical severity, CVSS 9.8 | Vulnix