CVE-2026-49981

Analyzed Analyzed - Analysis Complete

Twig Template Sandbox Policy Bypass in PHP

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49981

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.27.0, the system that checks which filters, tags, and functions are allowed in a template could incorrectly reuse a cached list from an earlier, less restrictive sandbox state. This means a template checked with a strict policy might later be used in a less secure context without re-evaluating its permissions.

Detection Guidance

To detect this vulnerability, check the installed version of Twig. If it is below 3.27.0, the system is vulnerable. Use commands like 'composer show twig/twig' or 'php -r "echo Twig\Twig\Environment::VERSION;"' to verify the version.

Impact Analysis

An attacker could exploit this to bypass intended security restrictions in a Twig template. If a template was initially allowed in a sandboxed environment but later reused in a less restricted context, unauthorized code execution or data access might occur, depending on the application's configuration.

Compliance Impact

This vulnerability could lead to unauthorized data access or code execution, violating confidentiality and integrity requirements in GDPR, HIPAA, and other regulations. Non-compliance risks include fines, legal penalties, and reputational damage due to failed security controls.

Mitigation Strategies

Update Twig to version 3.27.0 or later to address the cached policy bypass issue in sandboxed environments.

Hi! I’m here to help you understand CVE-2026-49981. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70