Which versions of Twig are affected by CVE-2026-24425?

Twig template engine versions 2.16.x and 3.9.0-3.25.x contain a sandbox bypass vulnerability (CVE-2026-24425, CVSS 8.7) enabling arbitrary PHP code execution when applications expose template editing…. A patch is available.

How to fix or mitigate CVE-2026-24425?

Within 24 hours: inventory all systems running Twig 2.16.x, 3.9.0-3.25.x and identify which applications expose template editing to users. Within 7 days: implement immediate access restrictions on template editing (trusted administrators only) and disable user-editable template features if non-critical to operations. Within 30 days: monitor Symfony security advisories and upgrade to patched versions immediately upon release.

Twig CVE-2026-24425

Q: What is the CVSS score of CVE-2026-24425?

CVE-2026-24425 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-31113 HIGH

Protection Mechanism Failure (CWE-693)

2026-05-20 disclosure@vulncheck.com

GHSA-2q52-x2ff-qgfr

PHP RCE Twig

8.7

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 20, 2026 - 15:17 EUVD

Source Code Evidence Fetched

May 20, 2026 - 14:30 vuln.today

Analysis Generated

May 20, 2026 - 14:30 vuln.today

DescriptionCVE.org

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

AnalysisAI

Sandbox bypass in Twig template engine versions 2.16.x and 3.9.0 through 3.25.x allows attackers with template rendering capabilities to execute arbitrary PHP code when the sandbox is enabled via a SourcePolicyInterface rather than globally. The runtime check on sort, filter, map, and reduce filters fails to propagate the current template source, allowing arbitrary PHP callables to be passed and executed. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the RCE/PHP tagging and CVSS 4.0 score of 8.7 indicate high impact for applications offering user-editable templates.

Technical ContextAI

Twig is a widely used PHP templating engine maintained by the Symfony ecosystem and bundled with frameworks such as Symfony, Drupal, and many CMS/SaaS platforms that permit user-supplied templates. The sandbox feature restricts which tags, filters, functions, and methods templates may invoke; SourcePolicyInterface lets applications toggle the sandbox per template source instead of globally. CWE-693 (Protection Mechanism Failure) is the root cause class: the fix commit ('propagate Source to checkArrow for source-policy sandboxing') shows that the runtime callable check for arrow-function-style filters (sort, filter, map, reduce) was evaluating against the wrong/missing template source context, so source-policy-enforced sandboxing was effectively skipped for those filters and arbitrary PHP callables passed in as arguments were honored.

RemediationAI

Vendor-released patch: Twig 3.26.0 - upgrade the twig/twig Composer dependency to 3.26.0 or later (the 2.16.x branch should likewise move to the maintained 3.x line, as no separate 2.x fix tag is referenced in the release notes). Pin via composer require twig/twig:^3.26 and redeploy, then verify with composer show twig/twig. If immediate upgrade is not possible, the most targeted compensating control is to stop relying on SourcePolicyInterface for sandboxing and switch to the global sandbox mode (SandboxExtension enabled unconditionally) until patched - this closes the bypass at the cost of applying sandbox restrictions to all templates, which may break trusted internal templates that use disallowed filters/functions. As a second-line control, restrict or remove the sort, filter, map, and reduce filters from the allow-list of the SecurityPolicy used by the sandbox; this blocks the specific filters abused by the bypass but breaks any legitimate templates that use them. Consult https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr for upstream guidance.