Arbitrary File Read in TwigView Plugin for CakePHP
CVE-2026-59191

6.9MEDIUM

Key Information:

Vendor

CakePHP

Status
Twig-view
Vendor
CVE Published:
11 November 2026

What is CVE-2026-59191?

The TwigView plugin for CakePHP has a vulnerability that arises when the FileLoader::findTemplate() function is supplied with unvalidated user-controlled input. This allows attackers to potentially read arbitrary files on the server, leading to exposure of sensitive information. It is critical to upgrade to versions 1.3.3 or 2.1.2 to mitigate this security issue effectively.

Affected Version(s)

twig-view < 1.3.3 < 1.3.3

twig-view >= 2.0.0, < 2.1.2 < 2.0.0, 2.1.2

References

https://github.com/cakephp/twig-view/security/advisories/...
x_refsource_CONFIRM
https://github.com/cakephp/twig-view/releases/tag/1.3.3
x_refsource_MISC
https://github.com/cakephp/twig-view/releases/tag/2.1.2
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.