CVE-2026-47732: Twig sandbox policy bypass via unguarded string coercion

CVE-2026-47732 · Severity: high · CVSS 0 · Published 2026-07-14

Twig is a popular template engine for PHP used to generate HTML and other text formats. A vulnerability in its security sandbox allows users with template-authoring permissions to bypass restrictions and execute the 'toString' method on unauthorized objects. This could lead to the exposure of sensitive data or internal system information that was intended to be protected by the sandbox environment.

Technologies: twig/twig (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-47732 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47732 being exploited in the wild.
How severe is CVE-2026-47732?
High severity, with a CVSS score of 0, published 14 July 2026.
Which products and versions are affected?
twig/twig (Packagist) <= 3.25.0, ECOSYSTEM:introduced=0,fixed=3.26.0.
Is there a fix for CVE-2026-47732?
Yes. twig/twig (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47732 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47732?
Check whether you run twig/twig (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/twig (Packagist): upgrade to 3.26.0 or later
    composer require twig/twig:^3.26.0

Technical details

The Twig sandbox fails to consistently enforce SecurityPolicy::checkMethodAllowed() during implicit string coercion. Specifically, the SandboxNodeVisitor used an incomplete list of AST nodes to wrap in CheckToStringNode. This allows a sandboxed template author to trigger the __toString() method on any object in the render context via constructs such as conditional expressions, comparison operators (==, !=, matches), template-loading tags, and the range operator. Attackers can use these bypasses to leak sensitive data or perform side-channel attacks to recover values byte-by-byte. The fix in version 3.26.0 introduces CoercesChildrenToStringInterface to ensure all coerced child nodes are properly guarded at runtime.

Affected products

  • twigphp Twig < 3.26.0

Identifiers

  • CVE-2026-47732
  • GHSA-pr2w-4gpj-cpq4

Timeline

  • 2026-05-19: patched: Initial fix commit authored
  • 2026-05-20: advisory: GHSA-pr2w-4gpj-cpq4 published and version 3.26.0 released
  • 2026-07-14: disclosed: CVE-2026-47732 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.