CVE-2026-49981: Twig Package Sandbox Filter Bypass Vulnerability
Summary
CVE-2026-49981: Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity() method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandbox... Affects twig/twig versions < 3.27.0. Fixed in 3.27.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Twig is a modern template engine for PHP, widely used for rendering templates in web applications. It provides a flexible and secure way to separate presentation logic from business logic. However, it has a vulnerability that affects its sandboxing feature, which is designed to restrict the execution of potentially dangerous code within templates.
Vulnerability Detail
The vulnerability arises from the way Twig handles security checks for filters, tags, and functions in sandboxed templates. The checks are performed during the construction of the template and cached for later use. If the sandbox state changes after the template is cached, the original security checks remain in effect, allowing potentially unsafe code to execute without proper validation. This can lead to unauthorized access or execution of malicious code, especially in environments where templates are shared between sandboxed and non-sandboxed contexts.
How To Fix
Minimum fixed version
3.27.0
This is the first release that contains the fix.
composer require twig/twig:3.27.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid sharing the same Twig Environment instance between sandboxed and non-sandboxed renders. Ensure that templates are instantiated in a way that maintains their intended security context.
Conclusion
The CVE-2026-49981 vulnerability in the Twig package poses a significant risk due to its potential to bypass security checks in sandboxed environments. It is crucial to update to the patched version 3.27.0 or later to safeguard your applications. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for twig/twig →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could allow attackers to execute unauthorized code within your application, potentially leading to data breaches or system compromise.
Yes, you can mitigate the risk by ensuring that sandboxed and non-sandboxed templates do not share the same Twig Environment instance.
The vulnerability was reported and fixed by Fabien Potencier, a key contributor to the Twig project.
References
Related vulnerabilities
Recent vulnerabilities recorded for twig/twig.
