Vulnerabilidades en twigphp
25 resultadosCVE-2022-23614HIGHCode injection in TwigEPSS 8.2%CVE-2022-39261HIGHTwig may load a template outside a configured directory when using the filesystem loaderEPSS 3.2%CVE-2024-45411HIGHTwig has a possible sandbox bypassEPSS 0.8%CVE-2026-46633HIGHTwig: PHP code injection via `{% use %}` template nameEPSS 0.8%CVE-2026-24425HIGHTwig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterfaceEPSS 0.8%CVE-2026-46640HIGHTwig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationEPSS 0.6%CVE-2026-46634HIGHTwig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameEPSS 0.6%CVE-2026-46636HIGHTwig: Sandbox method allowlist bypass via `Markup` subclassEPSS 0.6%CVE-2026-46627HIGHTwig: Sandbox resource exhaustion via unbounded `for` / `range()`EPSS 0.5%CVE-2026-46629MEDIUMTwig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled argumentsEPSS 0.5%CVE-2026-48805MEDIUMTwig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`EPSS 0.5%CVE-2026-46638MEDIUMTwig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)EPSS 0.5%CVE-2024-51754LOWUnguarded calls to __toString() when nesting an object into an array in TwigEPSS 0.4%CVE-2024-51755LOWUnguarded calls to __isset() and to array-accesses when the sandbox is enabled in TwigEPSS 0.4%CVE-2026-48806HIGHTwig: Sandbox `__toString()` policy bypass via dynamic mapping keysEPSS 0.4%CVE-2026-48808MEDIUMTwig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`EPSS 0.4%CVE-2026-47732HIGHTwig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion pointsEPSS 0.4%CVE-2026-46639HIGHTwig: Sandbox property and method bypass via object-destructuring assignmentEPSS 0.4%CVE-2026-48807HIGHTwig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filtersEPSS 0.4%CVE-2026-49981MEDIUMTwig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`EPSS 0.4%