# CVE-2026-59192: CakePHP TwigView unserialize filter arbitrary deserialization

Source: https://junglewise.ai/threats/cve-2026-59192-twigview-plugin-for-cakephp-provides-wrappers-for-common-view  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-59192 · Severity: info · Published 2026-11-11

The TwigView plugin for CakePHP, which provides Twig template integration for the CakePHP framework, contains an unrestricted deserialization filter that allows attackers to instantiate arbitrary PHP classes. An attacker who controls template content or can inject malicious serialized data could exploit this with existing PHP gadget chains to achieve remote code execution on the server.

Vendors: [Cakephp](https://junglewise.ai/threats/vendors/cakephp).

## Quick answers

**Is CVE-2026-59192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59192 being exploited in the wild.

**How severe is CVE-2026-59192?** Informational severity, published 11 November 2026.

**Which products and versions are affected?** Cakephp TwigView before 1.3.3 and 2.1.2.

**Is there a fix for CVE-2026-59192?** Yes: fixed in TwigView 1.3.3, 2.1.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59192 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59192?** Check whether you run Cakephp TwigView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in TwigView 1.3.3, 2.1.2

## Technical details

The unserialize Twig filter wraps PHP's unserialize() function without restricting allowed classes, enabling arbitrary object deserialization. An attacker providing crafted serialized input can trigger gadget chains present in the application's dependencies, leading to RCE. The fix restricts unserialize to disallow all object instantiation via the allowed_classes parameter.

## Affected products

- CakePHP TwigView before 1.3.3 and 2.1.2

## Timeline

- 2026-06-19: disclosed: Security issue reported by Volker Dusch and PHP Ecosystem security team
- 2026-06-20: patched
- 2026-11-11: advisory

## References

- [https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3](https://github.com/cakephp/twig-view/commit/99a59407b138a0efff0ce3896cbf67e71a9c9cd3)
- [https://github.com/cakephp/twig-view/pull/119](https://github.com/cakephp/twig-view/pull/119)

## Related threats

- [CakePHP TwigView path traversal in FileLoader](https://junglewise.ai/threats/cve-2026-59191-twigview-plugin-for-cakephp-provides-wrappers-for-common-view)