Executive brief
Twig is a popular template engine for PHP used to generate web pages. A security flaw in its 'sandbox' mode allows template authors to bypass security restrictions and view sensitive object data that should be hidden. This could lead to the exposure of internal system information or private user data if an application allows users to provide their own Twig templates.
Technical details
The 'column' filter in Twig versions prior to 3.26.0 passes object arrays directly to PHP's native array_column() function. Because array_column() accesses public and magic properties (__get, __isset) at the PHP engine level, it bypasses Twig's SandboxExtension::checkPropertyAllowed() validation. An attacker with permission to author templates and use the 'column' filter can read any public or magic property of objects within the render context, even if those properties are not on the sandbox allowlist. This is a regression or variant of previous sandbox bypasses (CVE-2024-51755). The fix in version 3.26.0 ensures that property reads within the filter are routed through Twig's sandbox-aware attribute accessor.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-20: patched: Fixed in version 3.26.0
- 2026-05-20: advisory: GitHub Security Advisory GHSA-vcc8-phrv-43wj published
- 2026-07-14: disclosed: CVE-2026-46635 published to NVD