Description
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP’s array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. The issue is a Class Interface Manipulation weakness (CWE-863) that enables unauthorized property access. This issue is fixed in version 3.26.0.

Affected Systems

The vulnerability affects Twig distributed by twigphp:Twig. Any installation running a Twig version earlier than 3.26.0 is vulnerable. Modern deployments of Twig 3.26.0 or later are not affected.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium overall severity, while the EPSS score of < 1% signals a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by providing a crafted template that utilizes the column filter, allowing them to read unrestricted object properties without triggering sandbox checks. The issue is specifically tied to the sandbox’s property allowlist and is mitigated by the fix released in version 3.26.0.

Generated by OpenCVE AI on July 31, 2026 at 04:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install Twig 3.26.0 or later to apply the vendor fix.
  • If an upgrade cannot be performed immediately, modify the sandbox configuration to remove the column filter from the list of allowed filters, preventing its use.
  • Audit current templates for usage of the column filter and refactor logic to avoid exposing sensitive data, such as replacing it with a safer alternative mechanism.

Generated by OpenCVE AI on July 31, 2026 at 04:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6311-1 php-twig security update
Github GHSA Github GHSA GHSA-vcc8-phrv-43wj Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
History

Wed, 15 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Twigphp
Twigphp twig
Vendors & Products Twigphp
Twigphp twig

Wed, 15 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
Title Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Twigphp Twig
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T13:26:27.106Z

Reserved: 2026-05-15T20:11:54.583Z

Link: CVE-2026-46635

cve-icon Vulnrichment

Updated: 2026-07-15T13:20:12.021Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:45:17Z

Weaknesses