twigphp Twig vulnerabilities

CVEs per yearBy the year they were published

1. 20222
2. 20243
3. 20251
4. 202619

Newest CVEs

• CVE-2026-46636

  Twig: Sandbox method allowlist bypass via `Markup` subclass

  twigphp · Twig

  High8.7
• CVE-2026-48807

  Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

  twigphp · Twig

  High7.1
• CVE-2026-48806

  Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

  twigphp · Twig

  High7.1
• CVE-2026-48808

  Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

  twigphp · Twig

  Medium6.0
• CVE-2026-48805

  Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

  twigphp · Twig

  Medium5.3
• CVE-2026-49981

  Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

  twigphp · Twig

  Medium6.0
• CVE-2026-46637

  Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

  twigphp · Twig

  Medium5.1
• CVE-2026-46638

  Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

  twigphp · Twig

  Medium6.0
• CVE-2026-46640

  Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

  twigphp · Twig

  High8.7
• CVE-2026-46629

  Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

  twigphp · Twig

  Medium5.3