CVE-2026-49981: fallo de gravedad media en twigphp Twig
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6epss 0.4%
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
twigphp · TwigCVEs relacionadas — twigphp Twig
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-23614HIGHCode injection in TwigEPSS 8.2%CVE-2022-39261HIGHTwig may load a template outside a configured directory when using the filesystem loaderEPSS 3.2%CVE-2024-45411HIGHTwig has a possible sandbox bypassEPSS 0.8%CVE-2026-24425HIGHTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceEPSS 0.8%CVE-2026-46633HIGHTwig: PHP code injection via `{% use %}` template nameEPSS 0.7%CVE-2026-46640HIGHTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationEPSS 0.6%