CVE-2026-46635

Analyzed Analyzed - Analysis Complete

Twig Template Engine Column Filter Property Exposure

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-46635

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.26.0, the column filter in Twig passes object arrays to PHP's array_column() function. This function reads public and magic properties without checking sandbox restrictions, allowing untrusted template authors with access to the column filter to read properties not explicitly allowed in the sandbox.

Detection Guidance

This vulnerability affects Twig versions prior to 3.26.0. To detect it, check the installed Twig version using commands like 'composer show twig/twig' or 'php -r "echo Twig\TwigFilter::VERSION . PHP_EOL;"'. If the version is below 3.26.0, the system is vulnerable.

Impact Analysis

An untrusted template author with access to the column filter could read sensitive properties that should be restricted by the sandbox. This may lead to unauthorized data exposure, such as internal application state or private object attributes, potentially compromising security or confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using vulnerable Twig versions may face compliance risks if data exposure occurs.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later to address the vulnerability in the column filter.

Hi! I’m here to help you understand CVE-2026-46635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70