PT-2026-42175 · Twig · Twig

Published 2026-05-20 · Updated 2026-05-22 · CVE-2026-46635

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description The column filter passes input directly to the native PHP array column() function. When array elements are objects, array column() reads properties directly, which bypasses the SandboxExtension::checkPropertyAllowed() check. This allows an untrusted template author with access to the column filter to read any public or magic property of any object within the render context, ignoring the allowedProperties list defined in the SecurityPolicy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-46635

GHSA-VCC8-PHRV-43WJ

Affected Products

Twig

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46635.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-46635 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46635 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vcc8-phrv-43wj · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46635 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46635 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46635 · Vendor Advisory
• https://github.com/twigphp/Twig · Note
• https://github.com/twigphp/Twig/security/advisories/GHSA-vcc8-phrv-43wj · Note
• https://symfony.com/blog/cve-2026-46635-sandbox-property-allowlist-bypass-via-the-column-filter-array-column-on-objects · Note
• https://twitter.com/symfony/status/2057046320813166656 · Twitter Post
• https://twitter.com/dailycve/status/2057639231070130376 · Twitter Post
• https://symfony.com/cve-2026-46635 · Note