Sandbox Bypass Vulnerability in Twig Product by Twig Vendor

CVE-2026-24425

What is CVE-2026-24425?

The vulnerability in Twig affects versions 2.16.x, 3.9.0 through 3.25.x, allowing attackers with template rendering capabilities to exploit a weakness in the SourcePolicyInterface. This weakness enables the passing of arbitrary PHP callables to various filters such as sort, filter, map, and reduce. By leveraging a flaw in the runtime check, attackers can circumvent sandbox restrictions and execute arbitrary code when the sandbox feature is used through a specific source policy setting. This issue could lead to significant security implications, especially in environments where the sandbox feature is enabled.

References