| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|
| twig/twig | composer | >= 1.0.0, < 1.12.3 | 1.12.3 |
The vulnerability was patched by adding 'ltrim($name, '/')' in the validateName method, indicating this function was the source of insufficient path validation. The security tests added in FilesystemTest.php specifically check for '/../' patterns, demonstrating this function's role in path resolution. The vulnerability description explicitly mentions the requirement for a leading slash in the attack vector, which aligns with the function's pre-patch behavior of not handling leading slashes before path component analysis.
KEV Misses 88% of Exploited CVEs- Get the report