Executive brief
Twig is a popular template engine for PHP used to generate HTML and other text formats. A vulnerability in its security sandbox allows users with template-authoring permissions to bypass restrictions and execute the 'toString' method on unauthorized objects. This could lead to the exposure of sensitive data or internal system information that was intended to be protected by the sandbox environment.
Technical details
The Twig sandbox fails to consistently enforce SecurityPolicy::checkMethodAllowed() during implicit string coercion. Specifically, the SandboxNodeVisitor used an incomplete list of AST nodes to wrap in CheckToStringNode. This allows a sandboxed template author to trigger the __toString() method on any object in the render context via constructs such as conditional expressions, comparison operators (==, !=, matches), template-loading tags, and the range operator. Attackers can use these bypasses to leak sensitive data or perform side-channel attacks to recover values byte-by-byte. The fix in version 3.26.0 introduces CoercesChildrenToStringInterface to ensure all coerced child nodes are properly guarded at runtime.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-19: patched: Initial fix commit authored
- 2026-05-20: advisory: GHSA-pr2w-4gpj-cpq4 published and version 3.26.0 released
- 2026-07-14: disclosed: CVE-2026-47732 published to NVD