The vulnerability in Twig (CVE-2026-24425) involves a sandbox bypass when using a SourcePolicyInterface. Attackers who can render templates can exploit the failure in the runtime check that does not correctly reference the current template source, allowing them to pass arbitrary PHP callables to filters such as sort, filter, map, and reduce. This bypasses sandbox restrictions and enables arbitrary code execution despite sandboxing being enabled through a source policy rather than globally. Affected versions include 2.16.x and 3.9.0 through 3.25.x. No official remediation or patch is currently documented.

Successful exploitation allows attackers with template rendering privileges to bypass sandbox restrictions and execute arbitrary PHP code. This can lead to full code execution within the context of the application using Twig, potentially compromising the host system or application data. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7, reflecting network attack vector, low attack complexity, no privileges required beyond template rendering, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling sandboxing through a SourcePolicyInterface or restrict template rendering capabilities to trusted users only. Monitor vendor communications for updates and patches addressing this vulnerability.