# cve.now: Twigphp

The newest entries naming Twigphp as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-46636](https://cve.now/CVE-2026-46636.md): Twig: Sandbox method allowlist bypass via \`Markup\` subclass (CVSS 8.7)
- [CVE-2026-48807](https://cve.now/CVE-2026-48807.md): Twig: Sandbox \`\_\_toString()\` policy bypass via \`Traversable\` in \`join\` and \`replace\` filters (CVSS 7.1)
- [CVE-2026-48806](https://cve.now/CVE-2026-48806.md): Twig: Sandbox \`\_\_toString()\` policy bypass via dynamic mapping keys (CVSS 7.1)
- [CVE-2026-48808](https://cve.now/CVE-2026-48808.md): Twig: Sandbox property allowlist bypass via the \`column\` filter under \`SourcePolicyInterface\` (CVSS 6.0)
- [CVE-2026-48805](https://cve.now/CVE-2026-48805.md): Twig: Sandbox state regression in deprecated internal wrappers in \`src/Resources/core.php\` (CVSS 5.3)
- [CVE-2026-49981](https://cve.now/CVE-2026-49981.md): Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached \`Template\` (CVSS 6.0)
- [CVE-2026-46637](https://cve.now/CVE-2026-46637.md): Twig: HTML-output filters in twig/\* extras incorrectly declared \`is\_safe =\> \['all'\]\` (CVSS 5.1)
- [CVE-2026-46638](https://cve.now/CVE-2026-46638.md): Twig: \`{% sandbox %}{% include %}\` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) (CVSS 6.0)
- [CVE-2026-46640](https://cve.now/CVE-2026-46640.md): Twig: Arbitrary PHP code execution via \`\_self.(\<string\>)\` macro-reference compilation (CVSS 8.7)
- [CVE-2026-46629](https://cve.now/CVE-2026-46629.md): Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments (CVSS 5.3)
- [CVE-2026-47730](https://cve.now/CVE-2026-47730.md): Twig: XSS in profiler HtmlDumper via unescaped template and profile names (CVSS 5.1)
- [CVE-2026-46628](https://cve.now/CVE-2026-46628.md): Twig: The \`spaceless\` filter implicitly marks its output as safe (CVSS 5.1)
- [CVE-2026-46634](https://cve.now/CVE-2026-46634.md): Twig: \`template\_from\_string()\` escapes a SourcePolicy-driven sandbox via synthesized template name (CVSS 7.7)
- [CVE-2026-46627](https://cve.now/CVE-2026-46627.md): Twig: Sandbox resource exhaustion via unbounded \`for\` / \`range()\` (CVSS 7.1)
- [CVE-2026-46633](https://cve.now/CVE-2026-46633.md): Twig: PHP code injection via \`{% use %}\` template name (CVSS 8.7)
- [CVE-2026-46639](https://cve.now/CVE-2026-46639.md): Twig: Sandbox property and method bypass via object-destructuring assignment (CVSS 7.1)
- [CVE-2026-46635](https://cve.now/CVE-2026-46635.md): Twig: Sandbox property allowlist bypass via the \`column\` filter (array\_column on objects) (CVSS 5.3)
- [CVE-2026-47732](https://cve.now/CVE-2026-47732.md): Twig Sandbox: multiple \`\_\_toString()\` policy bypasses via unguarded string coercion points (CVSS 7.1)
- [CVE-2026-24425](https://cve.now/CVE-2026-24425.md): Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface (CVSS 8.7)
- [CVE-2025-24374](https://cve.now/CVE-2025-24374.md): Twig fixes a security issue where escaping was missing when using null coalesce operator (??) (CVSS 4.3)
- [CVE-2024-51754](https://cve.now/CVE-2024-51754.md): Unguarded calls to \_\_toString() when nesting an object into an array in Twig (CVSS 2.2)
- [CVE-2024-51755](https://cve.now/CVE-2024-51755.md): Unguarded calls to \_\_isset() and to array-accesses when the sandbox is enabled in Twig (CVSS 2.2)
- [CVE-2024-45411](https://cve.now/CVE-2024-45411.md): Twig has a possible sandbox bypass (CVSS 8.6)
- [CVE-2022-39261](https://cve.now/CVE-2022-39261.md): Twig may load a template outside a configured directory when using the filesystem loader (CVSS 7.5)
- [CVE-2022-23614](https://cve.now/CVE-2022-23614.md): Code injection in Twig (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/twigphp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.