Security
فارسی
All products

twig/twig

Composer · Package
26 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Twig: PHP code injection via `{% use %}` template nameCVE-2026-46633 · GHSA-7P85-W9PX-JPJPVersion ranges need review. twig/twig Composer Critical Fix reported
Twig may load a template outside a configured directory when using the filesystem loaderCVE-2022-39261 · DRUPAL-CORE-2022-016Version ranges need review. drupal/coretwig/twig Composer High Fix reported
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`CVE-2026-49981 · GHSA-529H-VH3J-85HQ twig/twig Composer High Fix reported
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`CVE-2026-48805 · GHSA-P42Q-9PRX-Q5WQVersion ranges need review. twig/twig Composer Low Fix reported
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion pointsCVE-2026-47732 · GHSA-PR2W-4GPJ-CPQ4Version ranges need review. twig/twig Composer High Fix reported
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filtersCVE-2026-48807 · GHSA-8X9C-RMQH-456CVersion ranges need review. twig/twig Composer Medium Fix reported
Twig: XSS in profiler HtmlDumper via unescaped template and profile namesCVE-2026-47730 · GHSA-2G2G-8P8H-FGWM twig/twig Composer Low Fix reported
Twig: Possible sandbox bypass when using a source policyCVE-2026-24425 · GHSA-2Q52-X2FF-QGFRVersion ranges need review. twig/twig Composer High Fix reported
Twig: Sandbox property and method bypass via object-destructuring assignmentCVE-2026-46639 · GHSA-MM6W-GR99-P3JJ twig/twig Composer High Fix reported
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilationCVE-2026-46640 · GHSA-45VW-WH46-2VX8 twig/twig Composer High Fix reported
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template nameCVE-2026-46634 · GHSA-24X9-R6Q4-Q93W twig/twig Composer Medium Fix reported
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`CVE-2026-48808 · GHSA-H8VQ-8GPG-MHCGVersion ranges need review. twig/twig Composer Medium Fix reported
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keysCVE-2026-48806 · GHSA-5V5V-WW74-355VVersion ranges need review. twig/twig Composer Medium Fix reported
Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)CVE-2026-46635 · GHSA-VCC8-PHRV-43WJVersion ranges need review. twig/twig Composer Low Fix reported
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)CVE-2026-46638 · GHSA-7FXW-R6JV-74C8Version ranges need review. twig/twig Composer Medium Fix reported
Twig: The `spaceless` filter implicitly marks its output as safeCVE-2026-46628 · GHSA-4J38-F5CW-54H7Version ranges need review. twig/twig Composer Low Fix reported
Twig has a possible sandbox bypassCVE-2024-45411 · GHSA-6J75-5WFJ-GH66Version ranges need review. twig/twigtimber-library ComposerWordPress Medium Fix reported
Twig has unguarded calls to `__toString()` when nesting an object into an arrayCVE-2024-51754 · GHSA-6377-HFV9-HQF6Version ranges need review. twig/twig Composer Low Fix reported
Twig security issue where escaping was missing when using null coalesce operatorCVE-2025-24374 · GHSA-3XG3-CGVQ-2XWR twig/twig Composer Medium Fix reported
Twig Path Traversal vulnerability in the filesystem loaderGHSA-7CVR-XHM5-X998 · PKSA-G1ZX-TWCW-9Z6K twig/twig Composer Medium Fix reported