Twigphp - vulnerabilities (CVEs)

24 CVEs in 1 products, 0 in the last 30 days, newest from 2026-09-04.

Products

Twig - 24 CVEs

Newest CVEs of Twigphp

CVE-2026-46636 - CVSS 8.7 (high), 2026-09-04: Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method…
CVE-2026-48807 - CVSS 9.1 (critical), 2026-07-14: Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters…
CVE-2026-48806 - CVSS 9.1 (critical), 2026-07-14: Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke…
CVE-2026-48808 - CVSS 7.5 (high), 2026-07-14: Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source…
CVE-2026-48805 - CVSS 9.1 (critical), 2026-07-14: Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to…
CVE-2026-49981 - CVSS 8.2 (high), 2026-07-14: Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is…
CVE-2026-46637 - CVSS 5.4 (medium), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, several filters in twig/markdown-extra and twig/cssinliner-extra are registered with is_safe => [all],…
CVE-2026-46638 - CVSS 8.1 (high), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without…
CVE-2026-46640 - CVSS 8.8 (high), 2026-07-14: Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an…
CVE-2026-46629 - CVSS 6.5 (medium), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by…
CVE-2026-47730 - CVSS 5.4 (medium), 2026-07-14: Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML…
CVE-2026-46628 - CVSS 5.4 (medium), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit…
CVE-2026-46634 - CVSS 9.8 (critical), 2026-07-14: Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash>…
CVE-2026-46627 - CVSS 7.1 (high), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, the Twig sandbox does not prevent a template from consuming CPU, memory, or wall-clock time, even under…
CVE-2026-46633 - CVSS 9.8 (critical), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed…
CVE-2026-46639 - CVSS 7.1 (high), 2026-07-14: Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox…
CVE-2026-46635 - CVSS 5.3 (medium), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties…
CVE-2026-47732 - CVSS 7.1 (high), 2026-07-14: Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting…
CVE-2025-24374 - CVSS 4.3 (medium), 2025-01-29: Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This…
CVE-2024-51755 - CVSS 2.2 (low), 2024-11-06: Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy.…
CVE-2024-51754 - CVSS 2.2 (low), 2024-11-06: Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the…
CVE-2024-45411 - CVSS 8.6 (high), 2024-09-09: Twig is a template language for PHP. Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the…
CVE-2022-39261 - CVSS 7.5 (high), 2022-09-28: Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the filesystem loader…
CVE-2022-23614 - CVSS 9.8 (critical), 2022-02-04: Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers…