CVE-2026-46635: Symfony Twig Information Disclosure Issue

CVE-2026-46635 Overview

CVE-2026-46635 is a sandbox bypass vulnerability in Twig, a template language for PHP maintained by Symfony. Versions prior to 3.26.0 allow untrusted template authors to read object properties that should be blocked by the sandbox. The column filter passes object arrays directly to PHP's array_column() function, which reads public and magic properties without invoking CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(). When column is included in allowedFilters, template authors can access properties outside the sandbox allowlist. The issue is classified as an authorization flaw [CWE-863] and is fixed in Twig 3.26.0.

Critical Impact
Untrusted template authors can bypass Twig's sandbox property allowlist and read arbitrary public or magic properties of objects passed to templates.

Affected Products

Symfony Twig versions prior to 3.26.0
PHP applications relying on Twig SandboxExtension for untrusted template execution
Multi-tenant platforms exposing Twig template editing to end users

Discovery Timeline

2026-07-14 - CVE-2026-46635 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-46635

Vulnerability Analysis

Twig's sandbox mode restricts what template authors can access by enforcing an allowlist of tags, filters, functions, methods, and properties. Property access normally passes through CoreExtension::getAttribute(), which calls SandboxExtension::checkPropertyAllowed() before returning any value.

The column filter bypassed this control. Its implementation delegated directly to PHP's native array_column(), which reads properties from objects using PHP-level reflection semantics. As a result, both public properties and magic accessors such as __get() were reachable without any sandbox check. Any template author granted the column filter in allowedFilters could enumerate object state that administrators intended to remain hidden.

Root Cause

The root cause is a missing authorization check on an execution path that reads object attributes. The column filter was registered without the needs_environment and needs_is_sandboxed flags, so it lacked the context required to consult the sandbox. array_column() then read properties directly, sidestepping SandboxExtension::checkPropertyAllowed().

Attack Vector

Exploitation requires the attacker to author or influence a Twig template rendered under SandboxExtension with column present in allowedFilters. The attacker crafts a template that applies |column('propertyName') to a collection of objects supplied by the host application. Twig then returns values from properties the sandbox policy would otherwise deny, disclosing configuration data, credentials, or internal identifiers exposed on domain objects.

php

// Patch: src/Extension/CoreExtension.php
// The column filter is now registered with environment and sandbox context
// so it can enforce SandboxExtension::checkPropertyAllowed().
            new TwigFilter('sort', [self::class, 'sort'], ['needs_environment' => true, 'needs_is_sandboxed' => true]),
            new TwigFilter('merge', [self::class, 'merge']),
            new TwigFilter('batch', [self::class, 'batch']),
-            new TwigFilter('column', [self::class, 'column']),
+            new TwigFilter('column', [self::class, 'column'], ['needs_environment' => true, 'needs_is_sandboxed' => true]),
            new TwigFilter('filter', [self::class, 'filter'], ['needs_environment' => true, 'needs_is_sandboxed' => true]),
            new TwigFilter('map', [self::class, 'map'], ['needs_environment' => true, 'needs_is_sandboxed' => true]),
            new TwigFilter('reduce', [self::class, 'reduce'], ['needs_environment' => true, 'needs_is_sandboxed' => true]),

Source: Twig commit f05c501

Detection Methods for CVE-2026-46635

Indicators of Compromise

Twig templates authored by untrusted users containing the |column(...) filter applied to arrays of application objects.
Rendered output that contains values from object properties not declared in the sandbox allowedProperties list.
Application logs showing template renders that access domain entities via column before upgrading to Twig 3.26.0.

Detection Strategies

Grep template repositories for |column( usage and correlate against the allowedFilters and allowedProperties configuration passed to SandboxExtension.
Run a dependency inventory across PHP projects to identify installations of twig/twig at versions below 3.26.0 using composer show twig/twig.
Review Composer lock files and container images in CI pipelines to flag affected Twig versions before deployment.

Monitoring Recommendations

Enable structured logging for template rendering errors and sandbox violations reported by SandboxExtension.
Alert on newly submitted templates in multi-tenant systems that reference the column filter, pending upgrade.
Track outbound responses and API payloads for unexpected disclosure of object properties from applications that expose Twig editing to end users.

How to Mitigate CVE-2026-46635

Immediate Actions Required

Upgrade twig/twig to version 3.26.0 or later using composer update twig/twig.
Audit all SandboxExtension configurations and remove column from allowedFilters until the upgrade is complete.
Review objects exposed to sandboxed templates and confirm no sensitive data resides in public or magic-accessible properties.

Patch Information

The fix landed in Twig 3.26.0. The column filter is now registered with needs_environment and needs_is_sandboxed, and the underlying CoreExtension::column() implementation consults SandboxExtension::checkPropertyAllowed() before returning any property value. See the GitHub Security Advisory GHSA-vcc8-phrv-43wj and the Twig 3.26.0 release notes for full details.

Workarounds

Remove column from the allowedFilters array passed to SandboxExtension until Twig can be upgraded.
Restrict template authoring to trusted users and disable dynamic template submission from untrusted sources.
Move sensitive attributes off objects exposed to templates, or wrap them in DTOs that only expose sandbox-allowed properties.

bash

# Upgrade Twig to the patched release
composer require twig/twig:^3.26.0

# Verify the installed version
composer show twig/twig | grep versions

# Temporary mitigation: remove 'column' from allowedFilters in your SandboxExtension policy
# Example (PHP):
#   $policy = new SecurityPolicy($allowedTags, $allowedFilters, $allowedMethods, $allowedProperties, $allowedFunctions);
#   where $allowedFilters excludes 'column'