PT-2026-42583 · Packagist · Twig/Twig
Published
2026-05-21
·
Updated
2026-05-21
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Description
When the sandbox is enabled selectively via
SourcePolicyInterface (and not globally), a sandboxed template that is allowed to call template from string and include can render an arbitrary inner template with no security policy enforcement.Environment::createTemplate() compiles the inner string under a synthesized name ( string template <hash>), so a name/path-based SourcePolicy returns false for it, and the inner template's checkSecurity() becomes a no-op. From a template the integrator believes is sandboxed, an attacker can use any tag/filter/function (including constant() to read secrets, or |map("system") to execute shell commands).Resolution
This is a configuration trap rather than a code bug: there is no legitimate use case for exposing
template from string to untrusted template authors, and propagating the parent sandbox state through template from string would require invasive changes to SourcePolicyInterface semantics with their own risks.Starting with Twig 3.26.0, the documentation and the PHPDoc of
StringLoaderExtension::templateFromString() explicitly warn against allowing template from string in a sandboxed environment (i.e. listing it in a SecurityPolicy allowed-functions list). Integrators using a SourcePolicyInterface MUST NOT allow template from string in their allowed functions; the safest option is not to register StringLoaderExtension at all when a sandbox is in use.Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue.
Exploit
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Twig/Twig