Deserialization Vulnerability in TwigView Plugin for CakePHP
CVE-2026-59192

6.9MEDIUM

Key Information:

Vendor

CakePHP

Status
Twig-view
Vendor
CVE Published:
11 November 2026

What is CVE-2026-59192?

The TwigView plugin for CakePHP includes a vulnerability that allows unrestricted classes during unserialization. This flaw can potentially be exploited as a remote code execution vector, enabling attackers to execute arbitrary code within the application’s environment. To mitigate this risk, it’s crucial to update to versions 1.3.3 and 2.1.2 or later, where the unserialize filter has been secured to prevent unauthorized class access.

Affected Version(s)

twig-view < 1.3.3 < 1.3.3

twig-view >= 2.0.0, < 2.1.2 < 2.0.0, 2.1.2

References

https://github.com/cakephp/twig-view/security/advisories/...
x_refsource_CONFIRM
https://github.com/cakephp/twig-view/pull/119
x_refsource_MISC
https://github.com/cakephp/twig-view/pull/120
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.