Product by Twigphp

    Twig

    25 known vulnerabilities in Twig (Twigphp), 0 of them actively exploited (CISA KEV).

    Key figures

    25

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    7

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Twig (Twigphp)
    CriticalCVE-2022-23614

    Code injection in Twig

    also in 4 other products

    		8.8
    HighCVE-2022-39261

    Twig may load a template outside a configured directory when using the filesystem loader

    also in 5 other products

    		7.5
    CriticalCVE-2026-46633

    Twig: PHP code injection via `{% use %}` template name

    also in 2 other products

    		9.8
    CriticalCVE-2026-46634

    Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

    also in 2 other products

    		9.8
    HighCVE-2026-46636

    Twig: Sandbox method allowlist bypass via `Markup` subclass

    also in 1 other product

    		—
    CriticalCVE-2026-24425

    Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

    also in 2 other products

    		8.8
    HighCVE-2026-46640

    Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

    also in 2 other products

    		8.8
    CriticalCVE-2026-48805

    Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

    also in 2 other products

    		9.1
    CriticalCVE-2026-48806

    Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

    also in 1 other product

    		9.1
    HighCVE-2024-45411

    Twig has a possible sandbox bypass

    also in 2 other products

    		8.6
    HighCVE-2026-46638

    Twig: Protection Mechanism Failure

    also in 2 other products

    		8.1
    CriticalCVE-2026-48807

    Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

    also in 1 other product

    		9.1
    HighCVE-2026-46627

    Twig: Sandbox resource exhaustion via unbounded `for` / `range()`

    also in 2 other products

    		6.5
    MediumCVE-2026-46629

    Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

    also in 2 other products

    		6.5
    HighCVE-2026-49981

    Twig: Incorrect Authorization

    also in 1 other product

    		8.2
    HighCVE-2026-48808

    Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`

    also in 1 other product

    		7.5
    HighCVE-2026-47732

    Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

    also in 2 other products

    		6.5
    HighCVE-2026-46639

    Twig: Sandbox property and method bypass via object-destructuring assignment

    also in 1 other product

    		6.5
    MediumCVE-2026-46635

    Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

    also in 2 other products

    		4.3
    MediumCVE-2026-46637

    Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`

    also in 2 other products

    		5.4
    MediumCVE-2026-46628

    Twig: The `spaceless` filter implicitly marks its output as safe

    also in 2 other products

    		5.4
    MediumCVE-2026-47730

    Twig: XSS in profiler HtmlDumper via unescaped template and profile names

    also in 2 other products

    		5.4
    MediumCVE-2025-24374

    Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

    		4.3
    LowCVE-2024-51754

    Unguarded calls to __toString() when nesting an object into an array in Twig

    also in 1 other product

    		2.2
    LowCVE-2024-51755

    Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

    		2.2

    News

    All products by Twigphp