CVE-2026-47732

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9	Patch
https://github.com/twigphp/Twig/releases/tag/v3.26.0	Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Twig es un lenguaje de plantillas para PHP. Antes de la versión 3.26.0, varias construcciones del lenguaje Twig desencadenan la coerción de cadenas de PHP en un operando Stringable sin consultar SecurityPolicy::checkMethodAllowed(), lo que permite a un autor de plantillas en un entorno aislado invocar __toString() en objetos accesibles en el contexto de renderizado a través de expresiones condicionales, operadores de comparación, pruebas, etiquetas de carga de plantillas, nombres de atributos dinámicos, argumentos de propagación, la etiqueta do y el operador de rango ... Este problema está corregido en la versión 3.26.0.

Information

Published : 2026-07-14 22:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-47732

Mitre link : CVE-2026-47732

CVE.ORG link : CVE-2026-47732

JSON object : View

Products Affected

symfony

twig

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-47732", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47732", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T13:20:12.888618Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "twigphp", "product": "Twig", "versions": [{"status": "affected", "version": "< 3.26.0"}]}]}], "published": "2026-07-14T22:16:59.667", "references": [{"url": "https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0."}, {"lang": "es", "value": "Twig es un lenguaje de plantillas para PHP. Antes de la versi\u00f3n 3.26.0, varias construcciones del lenguaje Twig desencadenan la coerci\u00f3n de cadenas de PHP en un operando Stringable sin consultar SecurityPolicy::checkMethodAllowed(), lo que permite a un autor de plantillas en un entorno aislado invocar __toString() en objetos accesibles en el contexto de renderizado a trav\u00e9s de expresiones condicionales, operadores de comparaci\u00f3n, pruebas, etiquetas de carga de plantillas, nombres de atributos din\u00e1micos, argumentos de propagaci\u00f3n, la etiqueta do y el operador de rango ... Este problema est\u00e1 corregido en la versi\u00f3n 3.26.0."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "797B6432-E13E-450D-BF3C-8CEDA7D265F4", "versionEndExcluding": "3.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}