The vulnerability in Twig, a PHP template language, exists in versions before 3.26.0. It arises because multiple Twig language constructs cause PHP to coerce objects implementing the Stringable interface to strings by invoking their __toString() method without consulting SecurityPolicy::checkMethodAllowed(). This bypass allows sandboxed template authors to execute __toString() on objects reachable in the rendering context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the range operator. This behavior can lead to unintended method invocation within sandboxed environments. The vulnerability is resolved in Twig 3.26.0.

An attacker with the ability to author sandboxed templates can invoke the __toString() method on objects accessible in the rendering context without proper security policy checks. This may lead to unintended code execution paths or information disclosure within the sandboxed environment. The vulnerability affects the security boundary of sandboxed templates by allowing method invocation that should be restricted.

This vulnerability is fixed in Twig version 3.26.0. Users should upgrade to version 3.26.0 or later to remediate this issue. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed by the fix in version 3.26.0.