CVE-2026-49981

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/twigphp/Twig/commit/23eb6eb1267cb0d303b91eb5cff9b0c559c538a4	Patch
https://github.com/twigphp/Twig/releases/tag/v3.27.0	Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-529h-vh3j-85hq	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Twig es un lenguaje de plantillas para PHP. Antes de la versión 3.27.0, el veredicto de la lista de permitidos (allow-list) de filtros, etiquetas y funciones por plantilla se calcula cuando se construye una instancia de Template y puede permanecer en caché después de cambios de estado del sandbox entre renderizados, permitiendo que un renderizado posterior en sandbox reutilice una plantilla que fue verificada originalmente con una política diferente o vacía. Este problema se solucionó en la versión 3.27.0.

Information

Published : 2026-07-14 22:17

Updated : 2026-10-24 22:10

NVD link : CVE-2026-49981

Mitre link : CVE-2026-49981

CVE.ORG link : CVE-2026-49981

JSON object : View

Products Affected

symfony

twig

CWE

CWE-693

Protection Mechanism Failure

CWE-863

Incorrect Authorization

{"id": "CVE-2026-49981", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49981", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:57:43.577123Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "twigphp", "product": "Twig", "versions": [{"status": "affected", "version": "< 3.27.0"}]}]}], "published": "2026-07-14T22:17:13.070", "references": [{"url": "https://github.com/twigphp/Twig/commit/23eb6eb1267cb0d303b91eb5cff9b0c559c538a4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/releases/tag/v3.27.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-529h-vh3j-85hq", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0."}, {"lang": "es", "value": "Twig es un lenguaje de plantillas para PHP. Antes de la versi\u00f3n 3.27.0, el veredicto de la lista de permitidos (allow-list) de filtros, etiquetas y funciones por plantilla se calcula cuando se construye una instancia de Template y puede permanecer en cach\u00e9 despu\u00e9s de cambios de estado del sandbox entre renderizados, permitiendo que un renderizado posterior en sandbox reutilice una plantilla que fue verificada originalmente con una pol\u00edtica diferente o vac\u00eda. Este problema se solucion\u00f3 en la versi\u00f3n 3.27.0."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6B5C37C-83AB-43D0-9297-2D2B7815DF4A", "versionEndExcluding": "3.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}