Executive brief
Twig, a popular template engine for PHP applications, contains a security flaw in its sandbox mode. This mode is typically used to safely run untrusted code, such as user-submitted templates, by restricting access to sensitive functions. An attacker could bypass these restrictions to execute unauthorized functions or filters, potentially leading to data exposure or unauthorized actions within the application.
Technical details
A vulnerability in Twig's sandbox implementation allows a bypass of SecurityPolicy::checkSecurity() when using the {% sandbox %}{% include %} tag sequence. The issue occurs because templates previously loaded outside of a sandboxed environment are cached in Environment::$loadedTemplates. When these cached templates are subsequently included within a sandbox tag, the engine fails to re-invoke security checks, relying on the initial (non-sandboxed) security state. This allows an attacker who can author or influence the included template to execute tags, filters, and functions that should be restricted by the sandbox policy. This is an incomplete fix for a previous vulnerability (CVE-2024-45411) and is resolved in version 3.26.0.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-20: patched: Version 3.26.0 released
- 2026-05-20: advisory: GitHub Security Advisory GHSA-7fxw-r6jv-74c8 published
- 2026-07-14: disclosed: CVE-2026-46638 published to NVD