twigphp Twig
25 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-46636 | >= 1.0.0, < 3.27.0 | Twig: Sandbox method allowlist bypass via `Markup` subclass | HIGH 8.7 | 0.6 % | ||
| CVE-2026-48807 | < 3.27.0 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters | HIGH 7.1 | 0.4 % | ||
| CVE-2026-48806 | < 3.27.0 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | HIGH 7.1 | 0.4 % | ||
| CVE-2026-48808 | < 3.27.0 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-48805 | < 3.27.0 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-49981 | < 3.27.0 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-46637 | < 3.26.0 | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-46638 | < 3.26.0 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-46640 | >= 3.15.0, < 3.26.0 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | HIGH 8.7 | 0.6 % | ||
| CVE-2026-46629 | < 3.26.0 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments | MEDIUM 5.3 | 0.5 % | ||
| CVE-2026-47730 | >= 3.0.0, < 3.26.0 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-46628 | < 3.26.0 | Twig: The `spaceless` filter implicitly marks its output as safe | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-46634 | >= 3.9.0, < 3.26.0 | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name | HIGH 7.7 | 0.6 % | ||
| CVE-2026-46627 | < 3.26.0 | Twig: Sandbox resource exhaustion via unbounded `for` / `range()` | HIGH 7.1 | 0.5 % | ||
| CVE-2026-46633 | < 3.26.0 | Twig: PHP code injection via `{% use %}` template name | HIGH 8.7 | 0.7 % | ||
| CVE-2026-46639 | >= 3.24.0, < 3.26.0 | Twig: Sandbox property and method bypass via object-destructuring assignment | HIGH 7.1 | 0.4 % | ||
| CVE-2026-46635 | < 3.26.0 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-47732 | < 3.26.0 | Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points | HIGH 7.1 | 0.4 % | ||
| CVE-2026-24425 | 3.9.0 – < 3.26.0 ; 2.16.* | Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface | HIGH 8.7 | 0.8 % | ||
| CVE-2025-24374 | >= 3.16.0, < 3.19.0 | Twig fixes a security issue where escaping was missing when using null coalesce operator (??) | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-51754 | < 3.11.2 ; >= 3.12.0, < 3.14.1 | Unguarded calls to __toString() when nesting an object into an array in Twig | LOW 2.2 | 0.4 % | ||
| CVE-2024-51755 | < 3.11.2 ; >= 3.12.0, < 3.14.1 | Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig | LOW 2.2 | 0.4 % | ||
| CVE-2024-45411 | > 1.0.0, < 1.44.8 ; > 2.0.0, < 2.16.1 ; > 3.0.0, < 3.14.0 | Twig has a possible sandbox bypass | HIGH 8.6 | 0.8 % | ||
| CVE-2022-39261 | => 1.0.0, < 1.44.7 ; >= 2.0.0, < 2.15.3 ; >= 3.0.0, < 3.4.3 | Twig may load a template outside a configured directory when using the filesystem loader | HIGH 7.5 | 3.2 % | ||
| CVE-2022-23614 | >= 3.0.0, < 3.3.8 ; >= 2.0.0, < 2.14.11 | Code injection in Twig | CRITICAL 9.8 | 8.2 % |