twig/twig Security Advisories for v2.11.0 (17)
-
[HIGH] Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
PKSA-8zx5-v2nz-58pb CVE-2026-49981 GHSA-529h-vh3j-85hq
Affected version: <=3.26.0
Reported by:
GitHub -
[MEDIUM] Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
PKSA-fbvq-z33h-r2np CVE-2026-48808 GHSA-h8vq-8gpg-mhcg
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] Sandbox `__toString()` policy bypass via `Traversable` in `join`/`replace` and `in`/`not in` operators
PKSA-xx6c-6d96-db2w CVE-2026-48807 GHSA-8x9c-rmqh-456c
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] Sandbox `__toString()` policy bypass via dynamic mapping keys
PKSA-1tmc-rt7x-12w6 CVE-2026-48806 GHSA-5v5v-ww74-355v
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[LOW] Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
PKSA-g9zw-qxh8-pq8w CVE-2026-48805 GHSA-p42q-9prx-q5wq
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders
PKSA-yd6k-t2gh-1m43 CVE-2026-46636
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.27.0
Reported by:
FriendsOfPHP/security-advisories -
[HIGH] Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
PKSA-dpx1-78wg-1kqs CVE-2026-47732 GHSA-pr2w-4gpj-cpq4
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
PKSA-3mcc-k66d-pydb CVE-2026-46638 GHSA-7fxw-r6jv-74c8
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[LOW] Sandbox property allowlist bypass via the `column` filter (array_column on objects)
PKSA-n14z-jjjg-g8vd CVE-2026-46635 GHSA-vcc8-phrv-43wj
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[CRITICAL] PHP code injection via `{% use %}` template name
PKSA-h8hf-ytnd-5t9q CVE-2026-46633 GHSA-7p85-w9px-jpjp
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[LOW] The `spaceless` filter implicitly marks its output as safe
PKSA-sjvz-tbbr-vwth CVE-2026-46628 GHSA-4j38-f5cw-54h7
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
Sandbox does not protect against resource exhaustion
PKSA-kvv6-36cr-fkzb CVE-2026-46627
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0
Reported by:
FriendsOfPHP/security-advisories -
[LOW] Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
PKSA-2wrf-1xmk-1pky CVE-2024-51755 GHSA-jjxq-ff2g-95vh
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[LOW] Unguarded calls to __toString() when nesting an object into an array
PKSA-yhcn-xrg3-68b1 CVE-2024-51754 GHSA-6377-hfv9-hqf6
Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.11.2|>=3.12.0,<3.14.1
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] Possible sandbox bypass
PKSA-6319-ffpf-gx66 CVE-2024-45411 GHSA-6j75-5wfj-gh66
Affected version: >=1.0.0,<1.44.7|>=2.0.0,<2.16.0|>=3.0.0,<3.11.0|>=3.12.0,<3.14.0
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] Possibility to load a template outside a configured directory when using the filesystem loader
PKSA-n7sg-8f52-pqtf CVE-2022-39261 GHSA-52m2-vc4m-jj33
Affected version: >=1.0.0,<1.44.7|>=2.0.0,<2.15.3|>=3.0.0,<3.4.3
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] Disallow non closures in the sort filter
PKSA-8kk8-h2xr-h5nx CVE-2022-23614 GHSA-5mv2-rx3q-4w2v
Affected version: >=2.0.0,<2.14.11|>=3.0.0,<3.3.8
Reported by:
GitHub, FriendsOfPHP/security-advisories