CVE-2026-46639
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A vulnerability in the Twig template engine versions 3.24.0 through 3.26.0 causes object-destructuring assignment to compile CoreExtension::getAttribute() with the sandbox argument hardcoded to false. This disables property and method policy checks, allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine.
Risk Assessment
The organization is at risk of sensitive data leakage, as an attacker can read public properties or invoke public getters on objects available in the template, potentially exposing confidential information.
Recommendation
Immediately update the Twig library to version 3.26.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Twig
See all- CVE-2026-48807Critical
A vulnerability in the Twig template library for PHP allows sandbox bypass for Stringable objects when used with Traversable values in join and replace filters or in and not in operators. Prior to version 3.27.0, the sandbox __toString() checks did not fully cover these cases, enabling coercion to strings without sandbox policy enforcement.
- CVE-2026-48806Critical
A vulnerability in the Twig template library for PHP before version 3.27.0 allows bypassing the SandboxExtension::ensureToStringAllowed() check when coercing dynamic mapping keys to strings. An attacker can exploit a Stringable object used as an array key to invoke its __toString() method without proper sandbox validation.
- CVE-2026-48805Critical
A vulnerability in Twig before version 3.27.0 allows bypassing sandbox restrictions through deprecated internal wrappers in src/Resources/core.php. Functions like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() do not forward the current sandbox state to CoreExtension methods, enabling unauthorized callable execution.
- CVE-2026-46634Critical
A vulnerability in the Twig template library for PHP (versions 3.9.0 through 3.26.0) allows bypassing the SourcePolicyInterface sandbox security policy when rendering templates via the template_from_string() function. The inner template is compiled under a synthetic name that can fall outside the sandbox decision, enabling an attacker to execute code without security policy enforcement.
- CVE-2026-46633Critical
Vulnerability in the Twig template engine for PHP before version 3.26.0. The Compiler::string() function does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing injection of arbitrary PHP code into the compiled cache file.
- CVE-2026-49981High
A vulnerability in the Twig template library for PHP allows bypassing the sandbox mechanism. The allow-list of filters, tags, and functions is computed when a template instance is created and may remain cached after sandbox state changes between renders.
- CVE-2026-48808High
A vulnerability in the Twig template engine for PHP before version 3.27.0 causes the 'column' filter to pass the sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy.
- CVE-2026-47732Medium
A vulnerability in the Twig template engine before version 3.26.0 allows bypassing the sandbox mechanism. Several language constructs (conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the 'do' tag, and the '..' range operator) trigger string coercion on Stringable operands without checking SecurityPolicy::checkMethodAllowed().
- CVE-2026-47730Medium
In the Twig library (versions 3.0.0 through 3.26.0), the Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping. This allows an attacker to inject arbitrary HTML via controlled template or profile names when a browser renders the profiler dump.
- CVE-2026-46640High
A vulnerability in the Twig template library for PHP (versions 3.15.0 through 3.26.0) allows an attacker to inject PHP code via the _self.(<string>) and import-alias dynamic attribute syntax. Lack of identifier validation causes attacker-controlled strings to be emitted as raw PHP into the generated template source and executed at template-load time.
Original NVD description (English source)
Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. This issue is fixed in version 3.26.0.