GHSA-52m2-vc4m-jj33 Twig may load a template outside a configured directory when using the filesystem loader

• Packagist twig/twig: >= 1.0.0, < 1.44.7 → fixed in 1.44.7 • Packagist twig/twig: >= 2.0.0, < 2.15.3 → fixed in 2.15.3 • Packagist twig/twig: >= 3.0.0, < 3.4.3 → fixed in 3.4.3

Description When using the filesystem loader to load templates for which the name is a user input, it is possible to use the `source` or `include` statement to read arbitrary files from outside the templates directory when using a namespace like `@somewhere/../some.file` (in such a case, validation is bypassed). Resolution We fixed validation for such template names. Even if the 1.x branch is not maintained anymore, a new version has been released. Credits We would like to thank Dariusz Tytko for reporting the issue and Fabien Potencier for fixing the issue.