Twig versions 3.24.0 through 3.25.x have a vulnerability where object-destructuring assignment disables sandbox security checks by hardcoding the sandbox argument to false in CoreExtension::getAttribute(). This allows an attacker who can write to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine, potentially exposing sensitive data. The vulnerability is resolved in Twig 3.26.0. Several Ubuntu package versions of php-twig, including those for Ubuntu Pro LTS releases and Ubuntu 25.10, are affected.

An attacker with write access to a sandboxed Twig template can bypass sandbox restrictions to read public properties or invoke public getters on objects passed to the template engine. This could lead to unauthorized disclosure of information within the application context. There is no indication of privilege escalation or remote code execution. No known exploits in the wild have been reported.

Upgrade affected php-twig packages to version 3.26.0 or later where the vulnerability is fixed. Since this is a code-level vulnerability in the Twig template engine, patching to the fixed version is the recommended remediation. Patch status is confirmed fixed in 3.26.0. No other mitigations are indicated.