Twig versions from 1.0.0 up to but not including 3.27.0 contain a vulnerability where the SecurityPolicy::checkMethodAllowed() function unconditionally allows all method calls on instances of Twig\Markup and its subclasses. This flaw allows sandboxed templates to access every public method of Markup-derived objects, bypassing configured method restrictions. The issue was fixed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
Twig, a PHP template language, has a protection mechanism failure vulnerability in versions prior to 3.27.0. Deprecated internal wrappers in src/Resources/core.php do not correctly forward the current sandbox state to certain functions, allowing legacy calls to bypass sandbox callable restrictions. This issue is addressed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
Twig before version 3.26.0 improperly marks several filters in twig/markdown-extra and twig/cssinliner-extra as safe for all output contexts, including HTML, JavaScript, CSS, and URLs, without proper escaping. This can lead to improper encoding or escaping of output, potentially causing security issues. The vulnerability is fixed in version 3.26.0.
Twig, a PHP template language, has a protection mechanism failure vulnerability prior to version 3.26.0. The issue involves the sandbox feature where {% sandbox %}{% include %} can include a template previously loaded outside the sandbox without re-checking security policies. This allows cached templates to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). The vulnerability is fixed in version 3.26.0.
Twig, a PHP template language, has a code injection vulnerability (CWE-94) in versions from 3.15.0 up to but not including 3.26.0. The issue arises from improper validation of dynamic attribute syntax that allows attacker-controlled strings to be concatenated into MacroReferenceExpression names, resulting in raw PHP code execution at template load time. This vulnerability is rated high severity with a CVSS score of 8.7. The vulnerability is fixed in version 3.26.0.
Twig versions prior to 3.26.0 contain a vulnerability where IntlDateFormatter and NumberFormatter instances are memoized without limits based on template-controlled arguments. This can lead to excessive resource allocation that persists for the lifetime of the Twig environment. The issue is addressed in version 3.26.0.
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
Twig, a PHP template language, has an improper encoding vulnerability in versions prior to 3.26.0. The deprecated spaceless filter is incorrectly registered as safe for HTML, which causes Twig's autoescaping mechanism to fail and emit unescaped attacker-controlled markup when spaceless is applied to untrusted input. This vulnerability is fixed in version 3.26.0.
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
Twig versions prior to 3.26.0 have a vulnerability in the sandbox feature that allows untrusted templates to consume excessive CPU, memory, or wall-clock time, leading to resource exhaustion. The issue is documented in version 3.26.0, clarifying that the sandbox does not protect against such resource consumption. This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has a high severity rating with a CVSS score of 7.1.
Twig versions prior to 3.26.0 contain a code injection vulnerability due to improper escaping of single quotes in template names used in {% use %} tags. This allows crafted template names to inject arbitrary PHP code into compiled cache files. The issue is fixed in version 3.26.0.
Twig versions from 3.24.0 up to but not including 3.26.0 contain a protection mechanism failure where sandbox policy checks are disabled during object-destructuring assignment. This allows an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. The issue is fixed in version 3.26.0.
Twig versions prior to 3.26.0 contain an incorrect authorization vulnerability where the column filter passes object arrays to PHP's array_column() function. This allows reading of public and magic properties without sandbox checks, enabling an untrusted template author with column in allowedFilters to access properties outside the sandbox allowlist. The issue is fixed in version 3.26.0.
Twig versions prior to 3.26.0 contain an authorization vulnerability where certain language constructs cause PHP string coercion on Stringable objects without proper security checks. This allows sandboxed template authors to invoke the __toString() method on objects accessible in the rendering context, potentially bypassing intended sandbox restrictions. The issue is resolved in version 3.26.0.
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.
