CVE-2026-47732: Symfony Twig Privilege Escalation Flaw

CVE-2026-47732 Overview

CVE-2026-47732 is a sandbox bypass vulnerability in Twig, the template language for PHP maintained under the Symfony organization. Versions prior to 3.26.0 trigger PHP string coercion on Stringable operands without consulting SecurityPolicy::checkMethodAllowed(). This lets a sandboxed template author invoke __toString() on objects reachable in the render context. The bypass is exposed through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. The flaw is classified as an authorization issue [CWE-863] and affects deployments that rely on the Twig sandbox to isolate untrusted template authors.

Critical Impact
Untrusted template authors can invoke arbitrary __toString() methods on in-scope objects, bypassing the sandbox SecurityPolicy and potentially triggering unintended side effects or information disclosure.

Affected Products

Symfony Twig versions prior to 3.26.0
PHP applications using the Twig SandboxExtension for untrusted template rendering
Downstream frameworks and CMS platforms bundling vulnerable Twig releases

Discovery Timeline

2026-07-14 - CVE-2026-47732 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-47732

Vulnerability Analysis

Twig's sandbox mode enforces a SecurityPolicy that whitelists which methods, properties, tags, filters, and functions untrusted templates can invoke. The policy exposes checkMethodAllowed() to gate method calls, including the implicit __toString() magic method on objects passed into the render context.

Prior to version 3.26.0, several Twig language constructs coerced Stringable operands to strings without routing through the security policy. A template author operating inside the sandbox could reference an in-scope object in a conditional expression, comparison, test, do tag, spread argument, dynamic attribute name, template include target, or .. range endpoint. Each of those paths implicitly called __toString() on the object, executing code the sandbox was designed to block.

Root Cause

The compiled node tree lacked a mechanism to signal which child nodes would be string-coerced at runtime. As a result, SandboxExtension never wrapped those coercions with an ensureToStringAllowed() check. The fix introduces Twig\Node\CoercesChildrenToStringInterface so nodes can declare coercion behavior, and it adds an explicit Stringable check inside CoreExtension::getAttribute().

Attack Vector

Exploitation requires the attacker to author or modify a Twig template rendered inside a sandbox with access to at least one in-scope object exposing a sensitive __toString() implementation. The attack is network-reachable when the application accepts user-supplied templates, such as in multi-tenant CMS, email builders, or report designers.

php

    public static function getAttribute(Environment $env, Source $source, $object, $item, array $arguments = [], $type = Template::ANY_CALL, $isDefinedTest = false, $ignoreStrictCheck = false, $sandboxed = false, int $lineno = -1)
    {
        $propertyNotAllowedError = null;
+       if ($sandboxed && $item instanceof \Stringable) {
+           $env->getExtension(SandboxExtension::class)->ensureToStringAllowed($item, $lineno, $source);
+       }

        // array
        if (Template::METHOD_CALL !== $type) {

Source: twigphp/Twig commit 447d0b2 — this patch enforces the SandboxExtension policy before any implicit __toString() coercion inside getAttribute().

Detection Methods for CVE-2026-47732

Indicators of Compromise

Twig templates from untrusted sources containing do, .. range operators, spread arguments, or dynamic attribute expressions referencing context objects rather than scalars.
Application logs showing unexpected invocations of __toString() on domain, ORM, or service objects during template rendering.
Composer manifests or vendor/twig/twig/ installations pinned below version 3.26.0.

Detection Strategies

Inventory PHP applications for the twig/twig package and flag installations resolving to a version earlier than 3.26.0.
Static-analyze user-supplied templates for constructs known to trigger coercion: conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator.
Instrument SandboxExtension::ensureToStringAllowed() in patched environments and alert when calls are blocked, which indicates an author probing for the bypass.

Monitoring Recommendations

Enable verbose Twig sandbox logging and forward events to a centralized log platform for correlation with template author identity.
Track outbound requests, database reads, and file access initiated during template render windows to spot side effects from unauthorized __toString() calls.
Monitor dependency scanning output on every build so downgrades that reintroduce vulnerable Twig releases surface immediately.

How to Mitigate CVE-2026-47732

Immediate Actions Required

Upgrade twig/twig to version 3.26.0 or later across all PHP applications that render untrusted templates in sandbox mode.
Audit the render context supplied to sandboxed templates and remove any objects whose __toString() implementations perform sensitive operations.
Review recently rendered templates from untrusted authors for use of coercion-triggering constructs called out in the advisory.

Patch Information

The issue is fixed in Twig 3.26.0. Reference the GitHub Security Advisory GHSA-pr2w-4gpj-cpq4, the twigphp/Twig commit 447d0b2, and the Twig v3.26.0 release notes. The patch adds Twig\Node\CoercesChildrenToStringInterface so nodes declare which children are string-coerced at runtime, and it enforces ensureToStringAllowed() inside CoreExtension::getAttribute().

Workarounds

Restrict the render context passed to sandboxed templates to primitive types and arrays, avoiding objects that implement __toString().
Disable or reject templates containing the do tag, .. range operator, spread arguments, and dynamic attribute expressions until the upgrade is deployed.
Require code review and approval for any template authored outside the trusted developer team.

bash

# Upgrade Twig to a patched release
composer require twig/twig:^3.26.0

# Verify the installed version
composer show twig/twig | grep versions