CVE-2026-46635
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
CVE-2026-46635- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-44556
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
EUVD-2026-44556- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vcc8-phrv-43wj
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Description
The column filter passes its input straight to PHP's native array_column(). When the array elements are objects, array_column() reads $obj->$name (and $obj->$index) directly, including invoking __get/__isset. Because this property read happens entirely in PHP native code and never reaches CoreExtension::getAttribute(), SandboxExtension::checkPropertyAllowed() is never consulted.
An untrusted template author with column in their allowedFilters list can therefore read any public or magic property of any object reachable in the render context, regardless of the SecurityPolicy allowedProperties list. This is a variant of CVE-2024-51755 / GHSA-jjxq-ff2g-95vh that the ArrayAccess-focused fix did not cover.
Resolution
The column filter now routes object property reads through the sandbox-aware attribute accessor so the property allowlist is enforced.
Credits
Twig: would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-vcc8-phrv-43wj- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
CVE-2026-46635- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
CVE-2026-46635- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-46635
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
DEBIAN-CVE-2026-46635- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-vcc8-phrv-43wj
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Description
The column filter passes its input straight to PHP's native array_column(). When the array elements are objects, array_column() reads $obj->$name (and $obj->$index) directly, including invoking __get/__isset. Because this property read happens entirely in PHP native code and never reaches CoreExtension::getAttribute(), SandboxExtension::checkPropertyAllowed() is never consulted.
An untrusted template author with column in their allowedFilters list can therefore read any public or magic property of any object reachable in the render context, regardless of the SecurityPolicy allowedProperties list. This is a variant of CVE-2024-51755 / GHSA-jjxq-ff2g-95vh that the ArrayAccess-focused fix did not cover.
Resolution
The column filter now routes object property reads through the sandbox-aware attribute accessor so the property allowlist is enforced.
Credits
Twig: would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-vcc8-phrv-43wj- CVSS 4.0
- 2.1 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-46635
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
- Record
UBUNTU-CVE-2026-46635- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1783991054 No score
TuxCare security update for twig/twig (11 CVEs)
TuxCare rebuilt twig/twig to address 11 CVEs. Fixed in v2.16.1-p1+tuxcare.
- Record
CLSA-2026-1783991054- Updated
- 2026-11-02
OSVCLSA-2026-1784682913 No score
TuxCare security update for twig/twig (10 CVEs)
TuxCare rebuilt twig/twig to address 10 CVEs. Fixed in v2.15.6-p2+tuxcare.
- Record
CLSA-2026-1784682913- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
twig/twigPackagist |
before 3.26.0 | 3.26.0 |
twig/twigTuxCare:Packagist From an advisory covering 11 CVEs |
v2.16.1 up to v2.16.1-p1+tuxcare | v2.16.1-p1+tuxcare |
twig/twigTuxCare:Packagist From an advisory covering 10 CVEs |
v2.15.6 up to v2.15.6-p2+tuxcare, plus listed versions v2.15.6-p1+tuxcare |
v2.15.6-p2+tuxcare |
php-twigDebian:12 |
All versions, plus listed versions 3.10.1-13.10.3-13.11.0-13.13.0-13.14.0-1 Show 45 moreShow less3.14.0-23.14.0-33.14.0-43.14.2-13.14.2-23.14.2-33.15.0-13.15.0-23.17.1-13.17.1-23.18.0-13.18.0-23.18.0-43.18.0-53.18.0-63.18.0-73.19.0-13.19.0-1~bootstrap3.20.0-13.20.0-1~bootstrap3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-13.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-13.27.0-13.27.1-13.28.0-13.5.1-13.5.1-1+deb12u13.5.1-1+deb12u23.5.1-1+deb12u33.6.0-13.6.1-13.7.0-1 |
None known |
php-twigDebian:13 |
before 3.27.0-0+deb13u1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 11 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-0+deb13u13.26.0-1 |
3.27.0-0+deb13u1 |
php-twigDebian:14 |
before 3.26.0-1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 9 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-1 |
3.26.0-1 |
twig/twigPackagist |
before 3.26.0, plus listed versions 1.3.01.4.01.5.01.5.11.6.0 Show 45 moreShow less1.6.11.6.21.6.31.6.41.6.5v1.10.0v1.10.1v1.10.2v1.10.3v1.11.0v1.11.1v1.12.0v1.12.0-RC1v1.12.1v1.12.2v1.12.3v1.13.0v1.13.1v1.13.2v1.14.0v1.14.1v1.14.2v1.15.0v1.15.1v1.16.0v1.16.1v1.16.2v1.16.3v1.17.0v1.18.0v1.18.1v1.18.2v1.19.0v1.20.0v1.21.0v1.21.1v1.21.2v1.22.0v1.22.1v1.22.2v1.22.3v1.23.0v1.23.1v1.23.2v1.23.3 |
3.26.0 |
php-twigUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-12.12.5-1ubuntu0.1~esm12.12.5-1ubuntu0.1~esm2 |
None known |
php-twigUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu43.3.8-2ubuntu4+esm13.3.8-2ubuntu4+esm2 |
None known |
php-twigUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.7.0-13.7.1-13.8.0-23.8.0-2ubuntu0.1~esm13.8.0-2ubuntu13.8.0-2ubuntu1+esm1 |
None known |
php-twigUbuntu:25.10 |
All versions, plus listed versions 3.20.0-2ubuntu1 |
None known |
php-twigUbuntu:26.10 |
All versions, plus listed versions 3.23.0-2build73.27.1-13.28.0-1 |
None known |
php-twigUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 3.20.0-2ubuntu13.23.0-2build53.23.0-2build73.23.0-2ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46635 is a medium vulnerability (CVSS 5.3) in Symfony Twig, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in twig/twig 3.26.0.
References
github.com/twigphp/Twig/security/advisories/GHSA-vcc8-phrv-43wj
symfony.com/cve-2026-46635
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-46635
security-tracker.debian.org/tracker/CVE-2026-46635
ubuntu.com/security/CVE-2026-46635
cve.org/CVERecord?id=CVE-2026-46635
Left out here: 201 versions. The JSON record has them.