Twigphp vulnerabilities
25 CVEs and advisories name Twigphp as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-46636Twig: Sandbox method allowlist bypass via `Markup` subclass
- CVE-2026-48807Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
- CVE-2026-48806Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
- CVE-2026-48808Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- CVE-2026-48805Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- CVE-2026-49981Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
- CVE-2026-46637Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
- CVE-2026-46638Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
- CVE-2026-46640Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- CVE-2026-46629Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
- CVE-2026-47730Twig: XSS in profiler HtmlDumper via unescaped template and profile names
- CVE-2026-46628Twig: The `spaceless` filter implicitly marks its output as safe
- CVE-2026-46634Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
- CVE-2026-46627Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
- CVE-2026-46633Twig: PHP code injection via `{% use %}` template name
- CVE-2026-46639Twig: Sandbox property and method bypass via object-destructuring assignment
- CVE-2026-46635Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
- CVE-2026-47732Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
- CVE-2026-24425Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
- CVE-2025-24374Twig fixes a security issue where escaping was missing when using null coalesce operator (??)
- CVE-2024-51754Unguarded calls to __toString() when nesting an object into an array in Twig
- CVE-2024-51755Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig
- CVE-2024-45411Twig has a possible sandbox bypass
- CVE-2022-39261Twig may load a template outside a configured directory when using the filesystem loader
- CVE-2022-23614Code injection in Twig