Twig is a template language for PHP. Its deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(). This oversight allows legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. An attacker who can influence template rendering could exploit these wrappers to escape the sandbox, potentially executing arbitrary code and compromising the integrity of sandbox‑enforced limits. The vulnerability corresponds to CWE‑693, exposing a breakdown in system integrity expectations. The fix is incorporated in Twig version 3.27.0.

The vulnerability applies to all Twig PHP releases older than 3.27.0. The affected vendor is twigphp, product Twig. Users running any version before the 3.27.0 release are susceptible.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation would require the attacker to embed legacy wrapper calls within a template that is processed with sandbox mode enabled. The likely attack vector is inferred from the description: an attacker could inject calls such as twig_array_some() into a template rendered with sandbox mode. This inference follows the provided details, which do not explicitly state the attack path but logically extend from the vulnerability’s nature, indicating that legacy code usage is a prerequisite for exploitation.