# CVE-2026-59191: CakePHP TwigView path traversal in FileLoader

Source: https://junglewise.ai/threats/cve-2026-59191-twigview-plugin-for-cakephp-provides-wrappers-for-common-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-59191 · Severity: info · Published 2026-11-11

TwigView is a plugin for CakePHP that integrates the Twig templating engine. If a CakePHP application passes unsanitized user input to the template file loader, an attacker can read arbitrary files from the server, potentially exposing sensitive application code, configuration files, or other protected data.

Vendors: [Cakephp](https://junglewise.ai/threats/vendors/cakephp).

## Quick answers

**Is CVE-2026-59191 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59191 being exploited in the wild.

**How severe is CVE-2026-59191?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Cakephp TwigView before 1.3.3 and before 2.1.2.

**Is there a fix for CVE-2026-59191?** Yes: fixed in TwigView 1.3.3, 2.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59191 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59191?** Check whether you run Cakephp TwigView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in TwigView 1.3.3, 2.1.2

## Technical details

The FileLoader::findTemplate() method fails to properly validate user-controlled input passed to it, allowing path traversal attacks. An attacker with the ability to influence template names (typically through web request parameters or other input channels) can construct malicious paths to read files outside the intended template directory. This requires the vulnerable method to be called with untrusted data, but does not require authentication or additional preconditions beyond input control.

## Affected products

- CakePHP TwigView before 1.3.3 and before 2.1.2

## Timeline

- 2026-06-21: disclosed
- 2026-06-20: patched

## References

- [https://github.com/cakephp/twig-view/releases/tag/1.3.3](https://github.com/cakephp/twig-view/releases/tag/1.3.3)
- [https://github.com/cakephp/twig-view/releases/tag/2.1.2](https://github.com/cakephp/twig-view/releases/tag/2.1.2)

## Related threats

- [CakePHP TwigView unserialize filter arbitrary deserialization](https://junglewise.ai/threats/cve-2026-59192-twigview-plugin-for-cakephp-provides-wrappers-for-common-view)