CVE-2026-49981

A vulnerability in the Twig template library for PHP allows sandbox bypass for Stringable objects when used with Traversable values in join and replace filters or in and not in operators. Prior to version 3.27.0, the sandbox __toString() checks did not fully cover these cases, enabling coercion to strings without sandbox policy enforcement.

A vulnerability in the Twig template library for PHP before version 3.27.0 allows bypassing the SandboxExtension::ensureToStringAllowed() check when coercing dynamic mapping keys to strings. An attacker can exploit a Stringable object used as an array key to invoke its __toString() method without proper sandbox validation.

A vulnerability in Twig before version 3.27.0 allows bypassing sandbox restrictions through deprecated internal wrappers in src/Resources/core.php. Functions like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() do not forward the current sandbox state to CoreExtension methods, enabling unauthorized callable execution.

A vulnerability in the Twig template library for PHP (versions 3.9.0 through 3.26.0) allows bypassing the SourcePolicyInterface sandbox security policy when rendering templates via the template_from_string() function. The inner template is compiled under a synthetic name that can fall outside the sandbox decision, enabling an attacker to execute code without security policy enforcement.

Vulnerability in the Twig template engine for PHP before version 3.26.0. The Compiler::string() function does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing injection of arbitrary PHP code into the compiled cache file.

A vulnerability in the Twig template engine for PHP before version 3.27.0 causes the 'column' filter to pass the sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy.

A vulnerability in the Twig template engine before version 3.26.0 allows bypassing the sandbox mechanism. Several language constructs (conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the 'do' tag, and the '..' range operator) trigger string coercion on Stringable operands without checking SecurityPolicy::checkMethodAllowed().

In the Twig library (versions 3.0.0 through 3.26.0), the Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping. This allows an attacker to inject arbitrary HTML via controlled template or profile names when a browser renders the profiler dump.

A vulnerability in the Twig template library for PHP (versions 3.15.0 through 3.26.0) allows an attacker to inject PHP code via the _self.(<string>) and import-alias dynamic attribute syntax. Lack of identifier validation causes attacker-controlled strings to be emitted as raw PHP into the generated template source and executed at template-load time.

A vulnerability in the Twig template engine versions 3.24.0 through 3.26.0 causes object-destructuring assignment to compile CoreExtension::getAttribute() with the sandbox argument hardcoded to false. This disables property and method policy checks, allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine.