Twig is a PHP template language. The vulnerability is in ArrayExpression before version 3.27.0; dynamic mapping keys that are coerced to strings are not guarded. When a mapping key is a Stringable object, PHP calls its __toString() method without first invoking SandboxExtension::ensureToStringAllowed(), bypassing the sandbox's to-string restrictions. This failure to enforce a security policy (CWE-693) and improper handling of untrusted input during string coercion (CWE-863) can allow an attacker who can supply a template to trigger code execution or elevate privileges within the process.

The affected product is the Twig template engine, version 3.x from twigphp:Twig. Any installation running a Twig version older than 3.27.0 is susceptible. The issue is fixed in Twig 3.27.0 and later, which guards dynamic mapping keys before invoking __toString().

The CVSS score of 7.1 indicates a high risk to confidentiality, integrity, and availability. With an EPSS of less than 1%, exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker-controllable template that supplies a Stringable object as a mapping key, which triggers __toString() without sandbox enforcement, leading to local privilege escalation or code execution on the host where Twig runs.