Sandbox property allowlist bypass via the `column` filter (array_column on objects)

PKSA-n14z-jjjg-g8vd CVE-2026-46635

Affected package: twig/twig

Affected version: >=1.0.0,<2.0.0|>=2.0.0,<3.0.0|>=3.0.0,<3.26.0

Reported by:
FriendsOfPHP/security-advisories