CVE-2026-24425: twig from 2.16.0 (inclusive), through 2.16.1 (inclusive), from 3.9.0 (inclusive), before 3.26.0 (exclusive); +1 more…

Affected technology

twig · from 2.16.0 (inclusive), through 2.16.1 (inclusive)
symfony

twig · from 3.9.0 (inclusive), before 3.26.0 (exclusive)
symfony

Twig · 3.9.0 to before 3.26.0, 2.16.*
twigphp

Description’s affected range: versions 2.16.x and 3.9.0 through 3.25.x

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.