Executive brief
A vulnerability in the Twig template engine could allow an attacker to bypass security restrictions designed to isolate untrusted code. Twig is a popular tool used by web applications to generate dynamic content. If exploited, an attacker could execute unauthorized commands on the server, potentially leading to a full system takeover or theft of sensitive data.
Technical details
A sandbox bypass exists in Twig when the sandbox is enabled via a SourcePolicyInterface rather than globally. The vulnerability stems from a failure in the runtime check for callback-accepting filters (specifically sort, filter, map, and reduce) to verify the current template Source. This allows an attacker to pass arbitrary PHP callables instead of being restricted to Closure objects. Exploitation requires the ability to provide or modify a template that is processed under a source-based sandbox policy. The issue is resolved in version 3.26.0 by making callback sandbox checks source-aware.
Affected products
- twigphp Twig >= 2.16.0, <= 2.16.1
- twigphp Twig >= 3.9.0, < 3.26.0
Timeline
- 2026-05-20: disclosed
- 2026-06-05: advisory
- 2026-06-05: patched: Fixed in version 3.26.0