CVE-2026-47732

Analyzed Analyzed - Analysis Complete

Twig Sandbox Escape via String Coercion Prior to 3.26.0

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47732

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.26.0, certain Twig constructs could trigger PHP string coercion on Stringable objects without checking SecurityPolicy::checkMethodAllowed(). This allowed sandboxed template authors to call __toString() on reachable objects through various language features like conditional expressions, comparison operators, tests, and dynamic attribute names.

Detection Guidance

This vulnerability affects Twig versions prior to 3.26.0. To detect it, check the installed Twig version using commands like 'composer show twig/twig' or 'php -r "echo Twig\Twig\Environment::VERSION . PHP_EOL;"'. If the version is below 3.26.0, the system is vulnerable.

Impact Analysis

A malicious template author could exploit this to execute unintended code or access sensitive data by forcing string conversion on objects that should be restricted. This could lead to data leaks, unauthorized actions, or application compromise depending on the exposed objects.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or modification, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Twig versions may face compliance violations if exploited, potentially resulting in fines or legal consequences.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later to address the vulnerability. Review and update SecurityPolicy configurations to ensure proper checks are in place.

Hi! I’m here to help you understand CVE-2026-47732. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70