Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re‑invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). Based on this bypass, an attacker could potentially execute unauthorized functions or code within a sandboxed block, leading to code execution or privilege escalation. The issue is fixed in version 3.26.0.

All installations of Twig from the start of version 3 up through 3.25.x are vulnerable. The affected vendor is twigphp:Twig. Specific sub‑versions are not listed, but all pre‑3.26.0 releases share the flaw.

The CVSS score of 6 indicates moderate severity, while the EPSS of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to cause the application to load a template outside the sandbox and later include it within a sandboxed block without the security check running, which typically involves manipulating template paths or inclusion logic. If achieved, the impact is the execution of arbitrary, potentially dangerous PHP code within the application context.