Vulnerability details

CVE-2026-47732

twigphp Twig

Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

CVSS 4.0

7.1High

Official description

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
twigphp	Twig	< 3.26.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4 x_refsource_CONFIRM
https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9 x_refsource_MISC
https://github.com/twigphp/Twig/releases/tag/v3.26.0 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-15
Last updated: 2026-07-15
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.4%

Probability of exploitation in 30 days

34.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-863
Incorrect Authorization