PT-2026-42168 · Twig · Twig

Fabien Potencier + 2 · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-24425

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Twig versions 2.16.x Twig versions 3.9.0 through 3.25.x

Description A sandbox bypass exists when using a SourcePolicyInterface. This occurs because a runtime check fails to use the current template source, allowing attackers with template rendering capabilities to pass arbitrary PHP callables to the sort, filter, map, and reduce filters. This can lead to arbitrary code execution when the sandbox is enabled via a source policy instead of globally.

Recommendations Update Twig versions 2.16.x to a newer version containing the fix. Update Twig versions 3.9.0 through 3.25.x to a newer version containing the fix.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-24425

Affected Products

Twig

References · 5

• https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24425 · Security Note
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 · Note
• https://twitter.com/symfony/status/2057046272687698018 · Twitter Post
• https://vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface · Note