| CVE-2026-49981 |
|
High |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instanc
more...
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-48808 |
|
High |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current S
more...
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-48807 |
|
Critical |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace
more...
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-48806 |
|
Critical |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to
more...
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-48805 |
|
Critical |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state t
more...
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-47732 |
|
Medium |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without cons
more...
Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-47730 |
|
Medium |
Jul 14, 2026 |
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into
more...
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-46640 |
|
High |
Jul 14, 2026 |
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can concatenate an attacker-controlle
more...
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-46638 |
|
High |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox
more...
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
| CVE-2026-46637 |
|
Medium |
Jul 14, 2026 |
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [
more...
Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, and other contexts where the output is not properly escaped. This issue is fixed in version 3.26.0.
less...
|
v3.22.1, v3.22.0, v3.21.1, v3.21.0, v3.20.0, v3.19.0, v3.18.0, v3.17.1, v3.17.0, v3.16.0
|
