Open-source package vulnerability · Composer (PHP)
CVE-2024-34461: Zenario uses Twig filters insecurely in the Twig Snippet plugin
criticalCVSS 3.1 9.8GHSA-hr2r-w6wc-25pv
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
Published May 4, 2024 · Updated Mar 31, 2025
Affected packages
tribalsystems/zenario
- Ecosystem
- Composer (PHP)
- Affected
- < 9.5.60437
- Fixed in
- 9.5.60437
- Check
composer show tribalsystems/zenario
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology