Ttwigphp

Products

Exploited and recent CVEs

• CVE-2026-46636 High 8.7 Twig: Sandbox method allowlist bypass via `Markup` subclass 0.6%
• CVE-2026-48807 High 7.1 Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters 0.4%
• CVE-2026-48806 High 7.1 Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys 0.4%
• CVE-2026-48808 Medium 6.0 Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` 0.4%
• CVE-2026-48805 Medium 5.3 Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` 0.5%
• CVE-2026-49981 Medium 6.0 Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` 0.4%
• CVE-2026-46637 Medium 5.1 Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` 0.3%
• CVE-2026-46638 Medium 6.0 Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) 0.5%
• CVE-2026-46640 High 8.7 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation 0.6%
• CVE-2026-46629 Medium 5.3 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments 0.5%
• CVE-2026-47730 Medium 5.1 Twig: XSS in profiler HtmlDumper via unescaped template and profile names 0.3%
• CVE-2026-46628 Medium 5.1 Twig: The `spaceless` filter implicitly marks its output as safe 0.3%
• CVE-2026-46634 High 7.7 Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name 0.6%
• CVE-2026-46627 High 7.1 Twig: Sandbox resource exhaustion via unbounded `for` / `range()` 0.5%
• CVE-2026-46633 High 8.7 Twig: PHP code injection via `{% use %}` template name 0.8%
• CVE-2026-46639 High 7.1 Twig: Sandbox property and method bypass via object-destructuring assignment 0.4%
• CVE-2026-46635 Medium 5.3 Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) 0.3%
• CVE-2026-47732 High 7.1 Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points 0.4%
• CVE-2026-24425 High 8.8 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface 0.8%
• CVE-2025-24374 Medium 4.3 Twig fixes a security issue where escaping was missing when using null coalesce operator (??) 0.3%
• CVE-2024-51754 Low 2.2 Unguarded calls to __toString() when nesting an object into an array in Twig 0.4%
• CVE-2024-51755 Low 2.2 Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig 0.4%
• CVE-2024-45411 High 8.6 Twig has a possible sandbox bypass 0.8%
• CVE-2022-39261 High 7.5 Twig may load a template outside a configured directory when using the filesystem loader 3.2%
• CVE-2022-23614 High 8.8 Code injection in Twig 8.2%