CVE-2026-59191 · Package
NO FIX YET · SEE WHAT TO DO
TwigView is a CakePHP plugin that wraps View operations and Twig helpers. When unvalidated user input reaches FileLoader::findTemplate(), an attacker can read arbitrary files on the server.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the TwigView plugin with CakePHP and pass user-controlled data into template lookups. Apps that do not use TwigView, or that never feed request data into template names, are not exposed.
Not affected if no-twigview, validated-input
Who cares cakephp, php, twigview
composer.lock or with composer show dereuromark/cakephp-twigview.FileLoader::findTemplate() that receive request data without validation.1.3.3 for the 1.x line.2.1.2 for the 2.x line.TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.