Path Traversal in @rhinostone/swig Template Engine

The @rhinostone/swig package, a maintained fork of the legacy swig template engine, inherits a path traversal vulnerability originally documented as CVE-2023-25345. The vulnerability manifests within the filesystem loader's handling of {% include %}, {% extends %}, and {% import %} tags. When processing these tags, the engine fails to validate that the requested template path remains within the defined template root directory.

An attacker who can influence the path string, either through application logic that maps user-supplied data to template variables or by exploiting direct template manipulation, can insert traversal sequences like ../ to escape the root directory. This allows the reading of sensitive host files, such as /etc/passwd or application configuration files, which are subsequently returned in the rendered HTTP response. The flaw affects the primary @rhinostone/swig package and its core loader component, as well as several derivative engines including swig-twig, swig-jinja2, and swig-django.

Impact

Successful exploitation results in arbitrary local file disclosure. Depending on the server's permissions, this enables the exfiltration of critical information including application source code, database credentials, environment variables, and system-level configuration files. The impact is primarily on the confidentiality of the application and the host server.

Recommendation

Prioritized actions for security teams:

• Immediately update @rhinostone/swig and related packages to version 2.7.2 or later to mitigate CVE-2023-25345 while avoiding the regression introduced in 2.7.1.
• Audit application code for any instances where user-supplied input is directly passed as a variable into template include/extends tags.
• Configure the filesystem loader with an explicit and restrictive basepath if an immediate update is not feasible.