Skip to content

v2.0.2 — security patch (Twig CVEs)

Choose a tag to compare

View all tags
@bun4uk bun4uk released this 22 May 14:09
· 8 commits to main since this release
v2.0.2
911ee17
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Remediates seven advisories reported by Dependabot against bun4uk/chadmin by bumping twig/twig from 3.24.0 → 3.26.0 (composer).

Severity Advisory Summary
critical GHSA-7p85-w9px-jpjp PHP code injection via {% use %} template name
high GHSA-45vw-wh46-2vx8 RCE via _self.(<string>) macro reference compilation
high GHSA-mm6w-gr99-p3jj Sandbox bypass via object-destructuring assignment
medium GHSA-7fxw-r6jv-74c8 {% sandbox %}{% include %} skips checkSecurity() on cached templates
medium GHSA-24x9-r6q4-q93w template_from_string() escapes a SourcePolicy sandbox via synthesized name
low GHSA-vcc8-phrv-43wj Sandbox property allowlist bypass via the column filter
low GHSA-4j38-f5cw-54h7 spaceless filter implicitly marks its output as safe

Transitive composer bumps

  • symfony/deprecation-contracts 3.6.0 → 3.7.0
  • symfony/polyfill-ctype 1.36.0 → 1.37.0
  • symfony/polyfill-mbstring 1.36.0 → 1.37.0

Notes

Chadmin does not use the Twig sandbox at runtime, so there is no behavior change. The bump is published to silence Dependabot and keep Docker scanners green.

Images

  • Docker Hub: `docker pull bun4uk/chadmin:2.0.2` (also `2.0`, `2`, `latest`)
  • GHCR: `docker pull ghcr.io/bun4uk/chadmin:2.0.2`
Assets 2
Loading