CVE-2026-49981

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.27.0

Description In the template language for PHP, the allow-list verdict for filters, tags, and functions is computed during the construction of a Template instance and cached. This allows a sandboxed render to reuse a template that was originally checked with a different or empty policy if the sandbox state changes between renders. This occurs because the checkSecurity() method is invoked once from the constructor and the resulting verdict remains sticky within the Environment in $loadedTemplates.

Changes to the sandbox state—such as toggling SandboxExtension::enableSandbox() or disableSandbox(), swapping the policy via setSecurityPolicy(), or having a template pre-instantiated outside the sandbox—can cause the filters, tags, and functions to bypass the SecurityPolicy allow-list. Long-lived workers that share a single Environment between sandboxed and non-sandboxed renders are particularly exposed, as a non-sandboxed render can pre-warm a Template instance, causing subsequent sandboxed renders to skip the security check.

Recommendations Update Twig to version 3.27.0.