Twig is a template language for PHP. Prior to version 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties that are not allowed by the sandbox policy. This issue is fixed in version 3.27.0. The vulnerability is categorized under CWE‑693 and CWE‑863.

All installations of twigphp:Twig prior to version 3.27.0 are vulnerable. The fix is included in release 3.27.0. Users running Twig 3.26.x or earlier are impacted, regardless of the specific sub‑version.

The CVSS score of 6 reflects a medium severity risk, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker who can supply or otherwise influence template content that is processed under a sandboxed rendering context. The attack requires that the sandbox be active; if sandboxing is not enabled or if the template producer is fully trusted, the flaw has no effect. Exploitation does not require arbitrary code execution, but it can leak sensitive data otherwise protected by the sandbox.