PT-2026-45158 · Twig · Twig

CVE-2026-47732 · Published 2026-05-21 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description SandboxNodeVisitor fails to fully enforce SecurityPolicy::checkMethodAllowed() for implicit toString() calls because the set of wrapped AST nodes in CheckToStringNode is incomplete. This allows a sandboxed template author to invoke toString() on any object reachable in the render context, even if the method is not allowlisted. Bypass vectors include conditional expressions used as input for string-coercing filters or function arguments, the matches operator, loose comparison operators (==, !=, <, >, <=, >=, <=>), and Twig tests such as is empty via CoreExtension::testEmpty(). Additionally, null-coalesce expressions in concatenation, direct output of functions returning Stringable objects, arguments for allowed object methods, template-name expressions in tags like include, extends, and use, dynamic attribute names, spread arguments from Traversable objects, the do tag, and the .. range operator are affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-863

Related Identifiers

CVE-2026-47732

GHSA-PR2W-4GPJ-CPQ4

Affected Products

Twig

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47732.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47732.yaml · Exploit
• https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9 · Patch
• https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47732 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47732 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-47732 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pr2w-4gpj-cpq4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47732 · Security Note
• https://osv.dev/vulnerability/CVE-2026-47732 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47732 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47732 · Security Note
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 · Note
• https://github.com/twigphp/Twig · Note
• https://symfony.com/blog/cve-2026-47732-sandbox-multiple-tostring-policy-bypasses-via-unguarded-string-coercion-points · Note