Template Language Vulnerability in Twig by Twig

CVE-2026-49981

What is CVE-2026-49981?

Twig, a popular template language for PHP, has a vulnerability that arises from the handling of per-template filter, tag, and function allow-lists. Before version 3.27.0, the verdict for these lists was computed when a Template instance was constructed, leading to a risk where a cached template could be reused in a later sandboxed render, potentially bypassing the intended security policies. This flaw underscores the importance of keeping software updated, as it can lead to unintended access to templates that were initially vetted under different security conditions. The issue has been addressed in version 3.27.0, which is strongly recommended for all users.

References