CVE-2026-24425 is a sandbox bypass vulnerability in twigphp's Twig templating engine affecting versions 2.16.x and 3.9.0 through 3.25.x. The issue occurs when using a SourcePolicyInterface to enable sandboxing, allowing attackers with template rendering permissions to supply arbitrary PHP callables to filters such as sort, filter, map, and reduce. The runtime check intended to enforce sandbox restrictions fails to correctly validate the source context, enabling bypass of sandbox protections and arbitrary code execution. This vulnerability is classified under CWE-693 (Protection Mechanism Failure) and has a CVSS 4.0 score of 8.7 (high severity). No patch or official remediation level has been published, and no exploits are currently known in the wild.

Successful exploitation allows an attacker who can render templates to bypass sandbox restrictions and execute arbitrary PHP code within the context of the application. This can lead to unauthorized code execution, potentially compromising the affected system. The vulnerability affects specific Twig versions and requires the sandbox to be enabled via a SourcePolicyInterface, not globally. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid enabling sandboxing through a SourcePolicyInterface or restrict template rendering capabilities to trusted users only. Monitor vendor communications for updates on patches or official mitigations.