CVE-2026-59192— TwigView: Deserialization of Untrusted Data

Quick assessment

Affected

cakephp twig-view

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CakePHP 的 TwigView 插件为常见的视图操作及扩展提供了封装，并暴露了 CakePHP 函数以及 jasny/twig-extensions 提供的辅助功能。在版本 1.3.3 和 2.1.2 之前，unserialize 过滤器未对允许反序列化的类进行任何限制。攻击者可利用该漏洞作为反序列化远程代码执行（RCE）的利用链（gadget）。该问题已在版本 1.3.3 和 2.1.2 中得到修复。

CVSS 6.9 · Medium Updated Nov 11, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

TwigView: Deserialization of Untrusted Data

Source: CVE Program / CVE List V5

Vulnerability Description

TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

可信数据的反序列化

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cakephp	twig-view	< 1.3.3	-

II. Public POCs for CVE-2026-59192

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-59192

请登录查看更多情报信息。

Other References for CVE-2026-59192 (6)

https://github.com/cakephp/twig-view/pull/120 x_refsource_MISC
https://github.com/cakephp/twig-view/pull/119 x_refsource_MISC
https://github.com/cakephp/twig-view/releases/tag/2.1.2 x_refsource_MISC
https://github.com/cakephp/twig-view/releases/tag/1.3.3 x_refsource_MISC
https://github.com/cakephp/twig-view/security/advisories/GHSA-48qj-5wxh-m8hc x_refsource_CONFIRM
https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-59192

IV. Related Vulnerabilities

Same product: twig-view

CVE-2026-59191
TwigView: FileLoader is vulnerable to arbitrary file read

Same vendor: cakephp

Same weakness: CWE-502