TW
Product
Twig
25
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 7Medium 8Low 1
Watch
Add Twig to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24425 | 9.9 | May 20 | Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface Affected: 2.16.0 through 2.16.1; 3.9.0 before 3.26.0 |
| CVE-2026-46634 | 9.8 | Jul 14 | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name Affected: 3.9.0 before 3.26.0 |
| CVE-2026-46633 | 9.8 | Jul 14 | Twig: PHP code injection via `{% use %}` template name Affected: before 3.26.0 |
| CVE-2022-23614 | 9.8 | Feb 4 | Twig is an open source template language for PHP Affected: 2.0.0 before 2.14.11; 3.0.0 before 3.3.8 |
| CVE-2018-13818 | 9.8 | Jul 10 | Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter Affected: before 2.4.4 |
| CVE-2026-48807 | 9.1 | Jul 14 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters Affected: before 3.27.0 |
| CVE-2026-48806 | 9.1 | Jul 14 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys Affected: before 3.27.0 |
| CVE-2026-48805 | 9.1 | Jul 14 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` Affected: before 3.27.0 |
| CVE-2026-46640 | 8.8 | Jul 14 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation Affected: 3.15.0 before 3.26.0 |
| CVE-2024-45411 | 8.6 | Sep 9 | Twig has a possible sandbox bypass Affected: 1.0.0 before 1.44.8; 2.0.0 before 2.16.1; 3.0.0 before 3.14.0 |
| CVE-2026-49981 | 8.2 | Jul 14 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template` Affected: before 3.27.0 |
| CVE-2026-46638 | 8.1 | Jul 14 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) Affected: before 3.26.0 |
| CVE-2026-48808 | 7.5 | Jul 14 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface` Affected: before 3.27.0 |
| CVE-2022-39261 | 7.5 | Sep 28 | Twig is a template language for PHP Affected: 1.0.0 before 1.44.7; 2.0.0 before 2.15.3; 3.0.0 before 3.4.3 |
| CVE-2001-1537 | 7.5 | Dec 31 | The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain… Affected: through 2.7.4 |
| CVE-2026-46629 | 6.5 | Jul 14 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments Affected: before 3.26.0 |
| CVE-2026-46627 | 6.5 | Jul 14 | Twig: Sandbox resource exhaustion via unbounded `for` / `range()` Affected: before 3.26.0 |
| CVE-2026-46639 | 6.5 | Jul 14 | Twig: Sandbox property and method bypass via object-destructuring assignment Affected: 3.24.0 before 3.26.0 |
| CVE-2026-47732 | 6.5 | Jul 14 | Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points Affected: before 3.26.0 |
| CVE-2026-46637 | 5.4 | Jul 14 | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` Affected: before 3.26.0 |
| CVE-2026-47730 | 5.4 | Jul 14 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names Affected: 3.0.0 before 3.26.0 |
| CVE-2026-46628 | 5.4 | Jul 14 | Twig: The `spaceless` filter implicitly marks its output as safe Affected: before 3.26.0 |
| CVE-2026-46635 | 4.3 | Jul 14 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) Affected: before 3.26.0 |
| CVE-2019-9942 | 3.7 | Mar 23 | A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object… Affected: before 1.38.0; 2.0.0 before 2.7.0 |
| CVE-2015-7809 | – | Nov 6 | The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in… Affected: through 1.19.0 |
Showing 25