Twig is a PHP templating system that enforces a sandbox policy restricting how objects can be converted to strings. Before version 3.27.0 the sandbox's __toString checks were incomplete for Traversable objects passed to the join, replace, or used as operands of in and not in operators. As a result, Stringable objects inside those Traversable values could be coerced into strings without the sandbox policy being consulted, creating a mechanism for attackers to bypass the sandbox. This weakness, which is corrected in Twig 3.27.0, aligns with CWE‑693 and CWE‑863.

All Twig versions distributed by the twigphp project that precede 3.27.0 are affected. The fix was delivered in the 3.27.0 release and applies to all earlier releases regardless of major version. Applications embedding Twig whose templates may pass Traversable objects to the join or replace filters or to in/not in logic must be considered vulnerable until updated.

The CVSS base score of 7.1 indicates a High severity. The EPSS score of less than 1 % indicates a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker supplying or manipulating a template that passes Traversable objects to the vulnerable filters or operators, thereby bypassing the sandbox.