CVE-2026-24425 Overview
CVE-2026-24425 is a sandbox bypass vulnerability in the Twig PHP templating engine. The flaw affects Twig versions 2.16.x and 3.9.0 through 3.25.x when applications use a SourcePolicyInterface to scope sandbox enforcement. Attackers with template rendering capabilities can pass arbitrary PHP callables to the sort, filter, map, and reduce filters. The runtime check fails to use the current template source, allowing sandbox restrictions to be circumvented and arbitrary code to execute. The issue is classified under [CWE-693: Protection Mechanism Failure].
Critical Impact
Authenticated attackers who can supply or influence Twig templates can bypass the sandbox and execute arbitrary PHP code on the host application.
Affected Products
- Twig 2.16.x
- Twig 3.9.0 through 3.25.x
- PHP applications using SourcePolicyInterface for selective sandbox enforcement
Discovery Timeline
- 2026-05-20 - CVE-2026-24425 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-24425
Vulnerability Analysis
The vulnerability lives in Twig's sandbox enforcement logic when the sandbox is activated through a source policy rather than as a global setting. The SourcePolicyInterface lets developers decide on a per-template basis whether the sandbox should apply. The sort, filter, map, and reduce filters accept arbitrary PHP callables as arguments. Twig performs a runtime check intended to block dangerous callables when the sandbox is active. The check inspects the wrong template source context, so callables passed from a sandboxed template are not recognized as originating from sandboxed code. An attacker with the ability to author or influence template content can therefore invoke PHP functions that the sandbox is designed to forbid.
Root Cause
The runtime callable check does not consult the current template source. When sandbox enforcement is gated by SourcePolicyInterface, the check evaluates against an incorrect context and treats sandboxed input as trusted. This is a protection mechanism failure rather than a parsing or injection flaw.
Attack Vector
Exploitation requires the attacker to render a crafted Twig template that calls sort, filter, map, or reduce with a malicious callable such as a system command execution function. The attacker needs low-privilege access sufficient to submit or modify templates, for example through a CMS theme editor, user-customizable email templates, or a multi-tenant application that delegates template authoring. Successful exploitation yields arbitrary code execution under the privileges of the PHP process. See the GitHub Security Advisory GHSA-2q52-x2ff-qgfr for vendor technical detail.
No public exploit code is referenced in the advisory. The vulnerability is described in prose because no verified proof-of-concept has been published.
Detection Methods for CVE-2026-24425
Indicators of Compromise
- Twig templates that pass string-named PHP functions as callables to sort, filter, map, or reduce filters
- PHP process spawning shell interpreters (sh, bash, cmd.exe) from web server contexts running Twig-based applications
- Unexpected outbound network connections originating from PHP-FPM or web server workers
- New or modified .twig files in production template directories outside of release deployment windows
Detection Strategies
- Statically scan template repositories for uses of |sort(...), |filter(...), |map(...), and |reduce(...) where the argument is a string rather than an arrow function
- Monitor web application logs for unusual rendering errors referencing sandbox security policies
- Review composer dependency manifests for Twig versions in the affected ranges
Monitoring Recommendations
- Alert on child process creation from PHP interpreters in environments that should not invoke system binaries
- Track file integrity on template directories and trigger on unauthorized modification
- Centralize PHP error logs and search for Twig\Sandbox\SecurityError events that precede successful renderings
How to Mitigate CVE-2026-24425
Immediate Actions Required
- Upgrade Twig to version 3.26.0 or later as published in the GitHub Release v3.26.0
- Inventory all applications using Twig 2.16.x or 3.9.0 through 3.25.x and prioritize those that allow user-supplied templates
- Audit code for implementations of SourcePolicyInterface and validate the templates they govern
Patch Information
The Twig maintainers fixed the issue in version 3.26.0. The patch corrects the runtime callable check so it uses the current template source when determining whether sandbox restrictions apply. Refer to the VulnCheck Advisory on Twig Sandbox Bypass for additional fix detail.
Workarounds
- Enable the Twig sandbox globally instead of using SourcePolicyInterface until patches are applied
- Restrict template authoring privileges to trusted operators only
- Remove or override the sort, filter, map, and reduce filters in sandboxed environments to disallow callable arguments
- Deploy a Web Application Firewall rule that blocks template submissions containing string callables referencing PHP system functions
# Upgrade Twig via Composer
composer require twig/twig:^3.26.0
composer update twig/twig
# Verify installed version
composer show twig/twig | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
