What’s Vulnerable › Products
twigphp Twig vulnerabilities
29 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 22 published in the last 12 months.
Check whether your twigphp Twig version is affected
Latest twigphp Twig vulnerabilities
- CVE-2026-46636 — Twig: Sandbox method allowlist bypass via `Markup` subclass (CVSS 8.7)
- CVE-2026-49981 — Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` (CVSS 8.2)
- CVE-2026-48808 — Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` (CVSS 7.5)
- CVE-2026-48807 — Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters (CVSS 9.1)
- CVE-2026-48806 — Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys (CVSS 9.1)
- CVE-2026-48805 — Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` (CVSS 9.1)
- CVE-2026-47732 — Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points (CVSS 6.5)
- CVE-2026-47730 — Twig: XSS in profiler HtmlDumper via unescaped template and profile names (CVSS 5.4)
- CVE-2026-46640 — Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation (CVSS 8.8)
- CVE-2026-46639 — Twig: Sandbox property and method bypass via object-destructuring assignment (CVSS 6.5)
- CVE-2026-46638 — Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) (CVSS 8.1)
- CVE-2026-46637 — Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` (CVSS 5.4)
- CVE-2026-46635 — Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) (CVSS 4.3)
- CVE-2026-46634 — Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name (CVSS 9.8)
- CVE-2026-46633 — Twig: PHP code injection via `{% use %}` template name (CVSS 9.8)
- CVE-2026-46629 — Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments (CVSS 6.5)
- CVE-2026-46628 — Twig: The `spaceless` filter implicitly marks its output as safe (CVSS 5.4)
- CVE-2026-46627 — Twig: Sandbox resource exhaustion via unbounded `for` / `range()` (CVSS 6.5)
- CVE-2026-24425 — Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface (CVSS 9.9)
- CVE-2025-24374 — Twig fixes a security issue where escaping was missing when using null coalesce operator (??) (CVSS 4.3)
- CVE-2024-51755 — Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig (CVSS 2.2)
- CVE-2024-51754 — Unguarded calls to __toString() when nesting an object into an array in Twig (CVSS 2.2)
- CVE-2024-45411 — Twig has a possible sandbox bypass (CVSS 8.6)
- CVE-2022-39261 — Twig may load a template outside a configured directory when using the filesystem loader (CVSS 7.5)
- CVE-2022-23614 — Code injection in Twig (CVSS 9.8)