CVE-2026-49981 Overview
CVE-2026-49981 affects Twig, a widely used template language for PHP maintained by the Symfony project. The vulnerability exists in Twig versions prior to 3.27.0 and stems from how the sandbox extension caches per-template allow-list verdicts for filters, tags, and functions. When a Template instance is constructed, its policy verdict is computed once and reused across subsequent renders. If the sandbox state changes between renders, a later sandboxed render can reuse a template originally validated under a different or empty policy, bypassing the intended restrictions.
Critical Impact
Sandboxed template rendering may execute filters, tags, or functions that the current security policy would otherwise deny, resulting in confidentiality impact within the application context.
Affected Products
- Symfony Twig versions prior to 3.27.0
- PHP applications embedding Twig with the sandbox extension enabled
- Frameworks and content management systems bundling vulnerable Twig releases
Discovery Timeline
- 2026-07-14 - CVE-2026-49981 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-49981
Vulnerability Analysis
Twig ships a sandbox extension that restricts which tags, filters, and functions untrusted templates may invoke. The extension consults a security policy at render time to determine whether a template's constructs are permitted. In vulnerable releases, this verdict is computed during Template instance construction and cached on the instance.
The caching optimization becomes a security defect when the sandbox policy or its enabled state changes between renders of the same cached template. A template constructed while the sandbox was disabled, or while a permissive policy was active, retains that verdict. A subsequent render under a stricter policy reuses the cached decision instead of re-evaluating against the current policy. The issue is classified under CWE-693: Protection Mechanism Failure.
Root Cause
The root cause is stale state: sandbox verdicts are treated as a property of the template instance rather than a property of the current render context. Any policy mutation, sandbox enable/disable toggle, or per-request policy substitution performed after template construction fails to invalidate the cached decision.
Attack Vector
Exploitation requires an attacker with the ability to supply or influence template content that is rendered under a permissive context and later rendered under a stricter sandbox policy on the same Template instance. Applications that reuse Twig environments across requests, toggle sandbox state dynamically, or swap policies between renders are exposed. The attacker relies on the application's own render sequencing rather than on network conditions alone.
No public proof-of-concept exploit code has been published. Consult the Twig security advisory GHSA-529h-vh3j-85hq for the maintainer's technical description.
Detection Methods for CVE-2026-49981
Indicators of Compromise
- Rendered output containing filter, tag, or function results that the active sandbox policy should have blocked
- Application logs showing template renders that succeeded despite policy denials being expected
- Presence of Twig releases below 3.27.0 in composer.lock or vendored dependencies
Detection Strategies
- Inventory PHP applications and enumerate installed Twig versions using composer show twig/twig across all projects
- Audit application code for patterns that mutate sandbox policy or toggle SandboxExtension::enableSandbox() between renders on shared Environment instances
- Add unit tests that render the same template under differing policies to confirm the current runtime enforces per-render evaluation
Monitoring Recommendations
- Instrument Twig extensions with logging around policy checks to record which tags, filters, and functions are invoked per render
- Alert on template renders that produce output referencing sensitive functions when the caller expected the sandbox to be active
- Track dependency drift with software composition analysis to flag any regression to Twig releases prior to 3.27.0
How to Mitigate CVE-2026-49981
Immediate Actions Required
- Upgrade twig/twig to version 3.27.0 or later in every application manifest and rebuild deployment artifacts
- Review code paths that share a Twig Environment across requests with varying sandbox policies and refactor to construct policy-specific environments
- Restrict template authorship to trusted users until the upgrade is deployed to reduce the population of attacker-controlled templates
Patch Information
The fix is delivered in Twig 3.27.0. The maintainers published the corrective change in the upstream commit at twigphp/Twig commit 23eb6eb and the v3.27.0 release notes. The advisory and remediation details are documented in GHSA-529h-vh3j-85hq.
Workarounds
- Instantiate a fresh Twig Environment and Template for each distinct sandbox policy rather than mutating a shared instance
- Disable dynamic sandbox toggling and enforce a single, static policy for the lifetime of any given Template cache entry
- Clear the Twig template cache after any change to sandbox configuration to force re-evaluation on next construction
# Configuration example
composer require twig/twig:^3.27.0
composer update twig/twig
php bin/console cache:clear
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
