Skip to content
Symfony Twig vulnerabilities
-
symfony twig
Twig: Sandbox resource exhaustion via unbounded `for` / `range()`
CVE-2026-46627
Fix available
7.1 High
-
symfony twig
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
CVE-2026-49981
Fix available
6.0 Medium
-
symfony twig
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
CVE-2026-48808
Fix available
6.0 Medium
-
symfony twig
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
CVE-2026-48807
Fix available
7.1 High
-
symfony twig
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
CVE-2026-48806
Fix available
7.1 High
-
symfony twig
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
CVE-2026-48805
Fix available
5.3 Medium
-
symfony twig
Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVE-2026-47732
Fix available
7.1 High
-
symfony twig
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
CVE-2026-47730
Fix available
5.1 Medium
-
sensiolabs symfony, symfony twig-bridge, web-profiler-bundle +2 more
Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering
CVE-2026-45072
Fix available
2.0 Low
-
symfony twig
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
CVE-2026-46640
Fix available
8.7 High
-
symfony twig
Twig: Sandbox property and method bypass via object-destructuring assignment
CVE-2026-46639
Fix available
7.1 High
-
symfony twig
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
CVE-2026-46638
Fix available
6.0 Medium
-
symfony twig, twig cssinliner-extra, markdown-extra +2 more
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
CVE-2026-46637
Fix available
5.1 Medium
-
symfony twig
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
CVE-2026-46635
Fix available
5.3 Medium
-
symfony twig
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
CVE-2026-46634
Fix available
7.7 High
-
symfony twig
Twig: PHP code injection via `{% use %}` template name
CVE-2026-46633
Fix available
8.7 High
-
symfony twig
Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
CVE-2026-46629
Fix available
5.3 Medium
-
symfony twig
Twig: The `spaceless` filter implicitly marks its output as safe
CVE-2026-46628
Fix available
5.1 Medium
-
symfony twig
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
CVE-2026-24425
Fix available
8.7 High
-
symfony twig
Twig has a possible sandbox bypass
CVE-2024-45411
Fix available
8.6 High
-
sensiolabs symfony, debian linux, symfony twig-bridge +2 more
Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
CVE-2023-46734
Fix available
6.1 Medium
-
symfony twig, debian linux, drupal +1 more +3 more
Twig may load a template outside a configured directory when using the filesystem loader
CVE-2022-39261
Fix available
7.5 High
-
symfony twig, debian linux, fedoraproject fedora +2 more
Code injection in Twig
CVE-2022-23614
Public exploitFix available
8.8 High
-
symfony twig, debian linux +1 more
Twig Sandbox Information Disclosure
CVE-2019-9942
Fix available
3.7 Low
-
symfony twig
** DISPUTED ** Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search...
CVE-2018-13818
Disputed
9.8 Critical
-
symfony twig
Twig remote code execution in templates
CVE-2015-7809
Fix available
6.8 Medium
-
symfony twig
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores...
CVE-2001-1537
7.5 High