Fabien Potencier

A sandbox bypass exists when using a `SourcePolicyInterface`. This occurs because a runtime check fails to use the current template source, allowing attackers with template rendering capabilities to pass arbitrary PHP callables to the `sort`, `filter`, `map`, and `reduce` filters. This can lead to arbitrary code execution when the sandbox is enabled via a source policy instead of globally.

The issue arises when the filesystem loader loads templates for which the name is a user input. It is possible to use the `source` or `include` statement to read arbitrary files from outside the templates' directory when using a namespace like `@somewhere/../some.file`. In such a case, validation is bypassed.

A sandbox information disclosure issue exists because, under some circumstances, it is possible to call the ` toString()` method on an object even if not allowed by the security policy in place. This could allow a remote attacker to access confidential data.

The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by submitting a long password to the login form. This triggers an expensive hash computation, such as a PBKDF2 computation.