Is CVE-2026-59192 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59192 being exploited in the wild.

How severe is CVE-2026-59192?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Cakephp TwigView before 1.3.3 and 2.1.2.

Is there a fix for CVE-2026-59192?

Yes: fixed in TwigView 1.3.3, 2.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59192 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59192?

Check whether you run Cakephp TwigView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59192: CakePHP TwigView unserialize filter arbitrary deserialization

CVE-2026-59192 · Severity: info · Published 2026-11-11

The TwigView plugin for CakePHP, which provides Twig template integration for the CakePHP framework, contains an unrestricted deserialization filter that allows attackers to instantiate arbitrary PHP classes. An attacker who controls template content or can inject malicious serialized data could exploit this with existing PHP gadget chains to achieve remote code execution on the server.

Vendors: Cakephp.

Quick answers

Is CVE-2026-59192 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59192 being exploited in the wild.
How severe is CVE-2026-59192?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Cakephp TwigView before 1.3.3 and 2.1.2.
Is there a fix for CVE-2026-59192?: Yes: fixed in TwigView 1.3.3, 2.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59192 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59192?: Check whether you run Cakephp TwigView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: TwigView 1.3.3, 2.1.2

Technical details

The unserialize Twig filter wraps PHP's unserialize() function without restricting allowed classes, enabling arbitrary object deserialization. An attacker providing crafted serialized input can trigger gadget chains present in the application's dependencies, leading to RCE. The fix restricts unserialize to disallow all object instantiation via the allowed_classes parameter.

Affected products

CakePHP TwigView before 1.3.3 and 2.1.2

Timeline

2026-06-19: disclosed: Security issue reported by Volker Dusch and PHP Ecosystem security team
2026-06-20: patched
2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.