SecBoard
Zurück zur CVE-Übersicht

CVE-2026-49981

NONE
Risk Signal Score10/100 — NIEDRIG
  • Weniger als 24 Stunden alt

Beschreibung

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

GitHub Advisories

GHSA-529h-vh3j-85hqHIGH

Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

composer/twig/twig→ 3.27.0
GitHub Advisory

Referenzen