Twigphp Twig vulnerabilities

• twigphp twig Twig: Sandbox method allowlist bypass via `Markup` subclass CVE-2026-46636 Fix available 8.7 HighSeptember 4, 2026
• symfony twig Twig: Sandbox resource exhaustion via unbounded `for` / `range()` CVE-2026-46627 Fix available 7.1 HighJuly 14, 2026
• symfony twig Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` CVE-2026-49981 Fix available 6.0 MediumJuly 1, 2026
• symfony twig Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` CVE-2026-48808 Fix available 6.0 MediumJune 30, 2026
• symfony twig Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters CVE-2026-48807 Fix available 7.1 HighJune 30, 2026
• symfony twig Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys CVE-2026-48806 Fix available 7.1 HighJune 30, 2026
• symfony twig Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` CVE-2026-48805 Fix available 5.3 MediumJune 30, 2026
• symfony twig Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points CVE-2026-47732 Fix available 7.1 HighJune 5, 2026
• symfony twig Twig: XSS in profiler HtmlDumper via unescaped template and profile names CVE-2026-47730 Fix available 5.1 MediumJune 5, 2026
• symfony twig Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation CVE-2026-46640 Fix available 8.7 HighMay 21, 2026
• symfony twig Twig: Sandbox property and method bypass via object-destructuring assignment CVE-2026-46639 Fix available 7.1 HighMay 21, 2026
• symfony twig Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) CVE-2026-46638 Fix available 6.0 MediumMay 21, 2026
• symfony twig, twig cssinliner-extra, markdown-extra +2 more Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` CVE-2026-46637 Fix available 5.1 MediumMay 21, 2026
• symfony twig Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) CVE-2026-46635 Fix available 5.3 MediumMay 21, 2026
• symfony twig Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name CVE-2026-46634 Fix available 7.7 HighMay 21, 2026
• symfony twig Twig: PHP code injection via `{% use %}` template name CVE-2026-46633 Fix available 8.7 HighMay 21, 2026
• symfony twig Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments CVE-2026-46629 Fix available 5.3 MediumMay 21, 2026
• symfony twig Twig: The `spaceless` filter implicitly marks its output as safe CVE-2026-46628 Fix available 5.1 MediumMay 21, 2026
• symfony twig Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface CVE-2026-24425 Fix available 8.7 HighMay 20, 2026
• twigphp twig Twig fixes a security issue where escaping was missing when using null coalesce operator (??) CVE-2025-24374 Fix available 4.3 MediumJanuary 29, 2025
• twigphp twig Unguarded calls to __toString() when nesting an object into an array in Twig CVE-2024-51754 Fix available 2.2 LowNovember 6, 2024
• twigphp twig Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig CVE-2024-51755 Fix available 2.2 LowNovember 6, 2024
• symfony twig Twig has a possible sandbox bypass CVE-2024-45411 Fix available 8.6 HighSeptember 9, 2024
• symfony twig, debian linux, drupal +1 more +3 more Twig may load a template outside a configured directory when using the filesystem loader CVE-2022-39261 Fix available 7.5 HighSeptember 28, 2022
• symfony twig, debian linux, fedoraproject fedora +2 more Code injection in Twig CVE-2022-23614 Public exploitFix available 8.8 HighFebruary 4, 2022