PT-2026-42168 · Twig · Twig

Fabien Potencier + 2 · CVE-2026-24425 · Published 2026-05-20 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Twig versions 2.16.x Twig versions 3.9.0 through 3.25.x

Description A sandbox bypass exists when using a SourcePolicyInterface. This occurs because a runtime check fails to use the current template source, allowing attackers with template rendering capabilities to pass arbitrary PHP callables to the sort, filter, map, and reduce filters. This can lead to arbitrary code execution when the sandbox is enabled via a source policy instead of globally.

Recommendations Update Twig versions 2.16.x to a newer version containing the fix. Update Twig versions 3.9.0 through 3.25.x to a newer version containing the fix.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-24425

GHSA-2Q52-X2FF-QGFR

USN-8408-1

Affected Products

Twig

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24425.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-24425.yaml · Exploit
• https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8408-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24425 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-24425 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24425 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-24425 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2q52-x2ff-qgfr · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24425 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24425 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8408-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24425 · Security Note
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 · Note
• https://github.com/twigphp/Twig · Note