An attacker who can influence the path string, either through application logic that maps user-supplied data to template variables or by exploiting direct template manipulation, can insert traversal sequences like ../ to escape the root directory. This allows the reading of sensitive host files, such as /etc/passwd or application configuration files, which are subsequently returned in the rendered HTTP response. The flaw affects the primary @rhinostone/swig package and its core loader component, as well as several derivative engines including swig-twig, swig-jinja2, and swig-django.

Impact

Successful exploitation results in arbitrary local file disclosure. Depending on the server's permissions, this enables the exfiltration of critical information including application source code, database credentials, environment variables, and system-level configuration files. The impact is primarily on the confidentiality of the application and the host server.

Recommendation

Prioritized actions for security teams:

• Immediately update @rhinostone/swig and related packages to version 2.7.2 or later to mitigate CVE-2023-25345 while avoiding the regression introduced in 2.7.1.
• Audit application code for any instances where user-supplied input is directly passed as a variable into template include/extends tags.
• Configure the filesystem loader with an explicit and restrictive basepath if an immediate update is not feasible.