Twig EUVD-2026-31113

Exploitation requires (1) the target application uses Twig 2.16.x or 3.9.0-3.25.x, (2) the Twig sandbox is enabled through a SourcePolicyInterface implementation rather than the global SandboxExtension mode, and (3) the attacker has template rendering capability - i.e., can submit or modify Twig template source that will be rendered by the application (CVSS PR:L reflects this minimum authenticated/authorized capability). The attack uses the sort, filter, map, or reduce filters and supplies an arbitrary PHP callable as the arrow argument. Limiting factors: applications that do not expose templates to untrusted users, or that enable the sandbox globally (not via source policy), are not exploitable; UI:N means no victim interaction is needed once the malicious template is rendered.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:H/VA:H reflects network-reachable, low-complexity exploitation by an attacker who can already submit or render templates (PR:L), yielding full confidentiality/integrity/availability impact on the vulnerable component - consistent with arbitrary PHP code execution under the web server account. EPSS data was not supplied in the input, and there is no CISA KEV entry and no public PoC referenced, so this is currently a high-severity but not confirmed-exploited issue. The realistic risk is concentrated in deployments that (a) accept untrusted templates and (b) rely on SourcePolicyInterface rather than the global sandbox - typical of multi-tenant SaaS, marketing/email-builder platforms, and CMS plugins. For applications that never expose template editing to untrusted users, the practical risk is markedly lower than the 8.7 base score implies.

On a SaaS platform that lets tenant users edit email or page templates and enforces the Twig sandbox via a SourcePolicyInterface, an attacker with a normal tenant account submits a template that calls a filter such as {{ items|map(('system')) }} or passes 'shell_exec' / 'system' as the arrow argument to sort/filter/map/reduce. When the template is rendered, the runtime check fails to apply the source policy and the supplied PHP callable executes, yielding arbitrary code execution as the web server user. No public PoC is referenced in the supplied intelligence, but the patch commit (propagate Source to checkArrow for source-policy sandboxing) and tags (RCE, PHP) make the exploit primitive clear.