Disclosure summary
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
Source-reported weakness categories
CWE-693
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2026-24425
Open original source · Updated Oct 08, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| symfony | twig | * {"versionStartIncluding":"3.9.0","versionEndExcluding":"3.26.0"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Product, Release Notes
- github.com — Vendor Advisory
- www.vulncheck.com — Third Party Advisory
PUBLISHED 2026-05-20T10:16:38-04:00
MODIFIED 2026-10-08T12:17:11-04:00
INGESTED 2026-10-10T20:50:35-04:00