CVE-2026-59191

— UNSCOREDpublic exploit available

Published 2026-11-11 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2.

Weaknesses

CWE-22

Public exploit & PoC references

https://github.com/cakephp/twig-view/releases/tag/1.3.3
https://github.com/cakephp/twig-view/releases/tag/2.1.2
https://github.com/cakephp/twig-view/security/advisories/GHSA-hq9r-72jq-2pxp

All references

https://github.com/cakephp/twig-view/releases/tag/1.3.3
https://github.com/cakephp/twig-view/releases/tag/2.1.2
https://github.com/cakephp/twig-view/security/advisories/GHSA-hq9r-72jq-2pxp

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2012-20002PoC
HIGHCVE-2014-125130PoC
HIGHCVE-2014-125133PoC
HIGHCVE-2014-125134PoC
HIGHCVE-2015-20123PoC
HIGHCVE-2015-20124PoC
HIGHCVE-2015-20125PoC
HIGHCVE-2016-20100PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.