CVE-2026-46635: Twig sandbox property allowlist bypass in column filter

CVE-2026-46635 · Severity: medium · CVSS 4 · Published 2026-07-14

Twig is a popular template engine for PHP used to generate web pages. A security flaw in its 'sandbox' mode allows template authors to bypass security restrictions and view sensitive object data that should be hidden. This could lead to the exposure of internal system information or private user data if an application allows users to provide their own Twig templates.

Technologies: twig/twig (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46635 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46635 being exploited in the wild.
How severe is CVE-2026-46635?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
twig/twig (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0.
Is there a fix for CVE-2026-46635?
Yes. twig/twig (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46635 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46635?
Check whether you run twig/twig (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/twig (Packagist): upgrade to 3.26.0 or later
    composer require twig/twig:^3.26.0

Technical details

The 'column' filter in Twig versions prior to 3.26.0 passes object arrays directly to PHP's native array_column() function. Because array_column() accesses public and magic properties (__get, __isset) at the PHP engine level, it bypasses Twig's SandboxExtension::checkPropertyAllowed() validation. An attacker with permission to author templates and use the 'column' filter can read any public or magic property of objects within the render context, even if those properties are not on the sandbox allowlist. This is a regression or variant of previous sandbox bypasses (CVE-2024-51755). The fix in version 3.26.0 ensures that property reads within the filter are routed through Twig's sandbox-aware attribute accessor.

Affected products

  • twigphp Twig < 3.26.0

Identifiers

  • CVE-2026-46635
  • GHSA-vcc8-phrv-43wj

Timeline

  • 2026-05-20: patched: Fixed in version 3.26.0
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-vcc8-phrv-43wj published
  • 2026-07-14: disclosed: CVE-2026-46635 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.