Vulnerabilities

TI-2026-36076 CVE-2026-48807 · GHSA-8x9c-rmqh-456c

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

LOW 31

Twig is a template language for PHP.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00367 Published 2026-07-14 Fixed in 3.27.0 CWE-693

TI-2026-36075 CVE-2026-48806 · GHSA-5v5v-ww74-355v

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

LOW 32

Twig is a template language for PHP.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00418 Published 2026-07-14 Fixed in 3.27.0 CWE-693

TI-2026-36077 CVE-2026-48808 · GHSA-h8vq-8gpg-mhcg

Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

LOW 27

Twig is a template language for PHP.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-14 Fixed in 3.27.0 CWE-693

TI-2026-36074 CVE-2026-48805 · GHSA-p42q-9prx-q5wq

Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

LOW 33

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00483 Published 2026-07-14 Fixed in 3.27.0 CWE-693

TI-2026-36814 CVE-2026-49981 · GHSA-529h-vh3j-85hq

Protection mechanism failure in symfony Twig

LOW 27

Twig is a template language for PHP.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00362 Published 2026-07-14 Fixed in 3.27.0 CWE-693

TI-2026-34289 CVE-2026-46637 · GHSA-jv8m-2544-3pg3

Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

LOW 23

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00305 Published 2026-07-14 Fixed in 3.26.0 CWE-116

TI-2026-34290 CVE-2026-46638 · GHSA-7fxw-r6jv-74c8

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

LOW 27

Twig is a template language for PHP.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00473 Published 2026-07-14 Fixed in 3.26.0 CWE-693

TI-2026-34292 CVE-2026-46640 · GHSA-45vw-wh46-2vx8

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

MEDIUM 41

Twig is a template language for PHP.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00642 Published 2026-07-14 Fixed in 3.26.0 CWE-94

TI-2026-34284 CVE-2026-46629 · GHSA-35wc-cvqg-78fp

Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

LOW 25

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00542 Published 2026-07-14 Fixed in 3.26.0 CWE-770

TI-2026-35231 CVE-2026-47730 · GHSA-2g2g-8p8h-fgwm

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

LOW 23

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00295 Published 2026-07-14 Fixed in 3.26.0 CWE-79

TI-2026-34283 CVE-2026-46628 · GHSA-4j38-f5cw-54h7

Twig: The `spaceless` filter implicitly marks its output as safe

MEDIUM 56

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00295 Published 2026-07-14 Fixed in 3.26.0 CWE-116

TI-2026-34286 CVE-2026-46634 · GHSA-24x9-r6q4-q93w

Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

LOW 37

Twig is a template language for PHP.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00616 Published 2026-07-14 Fixed in 3.26.0 CWE-693

TI-2026-34282 CVE-2026-46627

Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

LOW 32

Twig is a template language for PHP.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00542 Published 2026-07-14 Fixed in 3.26.0 CWE-400

TI-2026-34285 CVE-2026-46633 · GHSA-7p85-w9px-jpjp

Twig: PHP code injection via `{% use %}` template name

MEDIUM 41

Twig is a template language for PHP.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00774 Published 2026-07-14 Fixed in 3.26.0 CWE-94

TI-2026-34291 CVE-2026-46639 · GHSA-mm6w-gr99-p3jj

Twig: Sandbox property and method bypass via object-destructuring assignment

LOW 31

Twig is a template language for PHP.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00394 Published 2026-07-14 Fixed in 3.26.0 CWE-693

TI-2026-34287 CVE-2026-46635 · GHSA-vcc8-phrv-43wj

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

LOW 24

Twig is a template language for PHP.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00331 Published 2026-07-14 Fixed in 3.26.0 CWE-863

TI-2026-35233 CVE-2026-47732 · GHSA-pr2w-4gpj-cpq4

Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

LOW 31

Twig is a template language for PHP.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-14 Fixed in 3.26.0 CWE-863

TI-2026-19691 CVE-2026-24425 · GHSA-2q52-x2ff-qgfr

Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

MEDIUM 41

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort,…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00758 Published 2026-05-20 Fixed in 3.26.0 CWE-693

TI-2024-30460 CVE-2024-45411 · GHSA-6j75-5wfj-gh66

Twig has a possible sandbox bypass

MEDIUM 41

Twig is a template language for PHP.

CVSS 3.1HIGH 8.6 Network Low privileges No interaction EPSS 0.00849 Published 2024-09-09 Fixed in 1.44.8, 2.16.1 +2 CWE-693

TI-2022-18637 CVE-2022-39261 · GHSA-52m2-vc4m-jj33

Twig may load a template outside a configured directory when using the filesystem loader

MEDIUM 45

Twig is a template language for PHP.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03174 Published 2022-09-28 Fixed in 2.15.3, 3.4.3 +1 CWE-22

TI-2022-07667 CVE-2022-23614 · GHSA-5mv2-rx3q-4w2v

Code injection in Twig

MEDIUM 54

Twig is an open source template language for PHP.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08209 Published 2022-02-04 Fixed in 3.3.8, 2.14.11 CWE-74

TI-2019-07311 CVE-2019-9942 · GHSA-vxrc-68xx-x48g

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0…

LOW 20

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.01405 Published 2019-03-23 Fixed in 1.38.0, 2.7.0 CWE-200

TI-2018-10028 CVE-2018-13818 · GHSA-rgff-87c8-rh44

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key…

MEDIUM 52

Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06902 Published 2018-07-10 No fix listed CWE-94

TI-2015-06486 CVE-2015-7809 · GHSA-xw83-pwrm-9j74

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox…

LOW 36

The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03398 Published 2015-11-06 Fixed in 1.20.0 CWE-264

TI-2001-01485 CVE-2001-1537 · GHSA-f465-339w-2vhm

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier…

LOW 35

The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privil…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01257 Published 2005-07-14 No fix listed CWE-312

Vulnerabilities

Filters