Technical impact
Twig, a PHP template language, has a vulnerability that allows an attacker who can write templates into a sandboxed environment to bypass sandbox property and method restrictions. The flaw arises from object‑destructuring assignment that compiles CoreExtension::getAttribute() with the sandbox flag hard‑coded to false, disabling property and method policy checks. As a result, an attacker can read public properties or invoke public getters on objects passed to Twig. This issue existed in Twig versions 3.24.0 through 3.25.0 and is fixed in version 3.26.0. The weakness is identified as CWE‑693, indicating a failure to preserve the integrity of data used by a trusted component.
Affected Systems
The affected product is Twig, the templating engine from the vendor twigphp. Versions from 3.24.0 up to, but excluding, 3.26.0 are impacted. Users running any of those releases on PHP installations should consider the product vulnerable.
Risk and Exploitability
The CVSS score of 7.1 reflects a medium to high severity. The EPSS score of less than 1% indicates a low probability of exploitation at the present time, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker who can supply or alter template files within a sandboxed Twig instance. If such write access is available—perhaps via a web application that echoes user‑produced templates—then the sandbox bypass could be achieved. The vulnerability exploits a design flaw in the default configuration, so the risk is mitigated by ensuring that sandbox usage is properly enforced or disabled.
Github GHSA