Twig is a template language for PHP. Before version 3.26.0, several language constructs in Twig trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(). This allows a sandboxed template author to invoke __toString() on objects reachable in the render context via conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. As a result, sandbox policy is bypassed, letting the attacker read or manipulate the underlying object data. The vulnerability is classified as CWE‑863.

The vulnerability affects the Twig template engine for PHP (twigphp:Twig). All releases before 3.26.0 are susceptible, regardless of the specific minor or patch number. Individuals deploying older Twig versions in any environment that accepts user‑supplied templates must consider their risk. Updates are available from twigphp’s GitHub releases; version 3.26.0 and later contain the policy fix.

The CVSS base score is 7.1, indicating a moderate‑to‑high impact. The EPSS score is reported as < 1 %, suggesting that automated exploitation is currently unlikely, but the lack of KEV listing does not diminish the potential for targeted attacks. The likely attack vector is through the sandboxed template language itself: an attacker who can upload or influence templates can embed expressions that trigger string coercion, thereby invoking __toString() on a context object. Because the sandbox policy is bypassed, the attacker can read or manipulate object data. Given the moderate CVSS and low exploit probability, immediate remediation is advisable for any system that accepts templates from untrusted sources.