Critical severity · published May 20, 2026
CVE-2026-24425
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
9.9
CVSS
0.8%
EPSS
No
On KEV
Description
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twig · twigphp
3.9.0 before 3.26.0; 2.16.* · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24425
vendor-advisory
https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr
release-notes
https://github.com/twigphp/Twig/releases/tag/v3.26.0
third-party-advisory
https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface
More from Twig
9.8
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
9.8
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
9.1
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
9.1
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
9.1
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`