CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface

What is CVE-2026-24425?

CVE-2026-24425 is a high-severity vulnerability in twigphp Twig, published on 20 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

Weakness: CWE-693

Which versions are affected by CVE-2026-24425?

4 open source packages ship an affected version, including twig/twig. It affects 1 product.

Products include Symfony Twig.

How do I fix CVE-2026-24425?

Upgrade twig/twig to 3.26.0 or later.

Is CVE-2026-24425 being exploited?

There is no known exploitation of CVE-2026-24425 in the wild and no public exploit code.

Other vulnerabilities in twigphp Twig

• CVE-2018-13818 Code injection in n/a Critical 9.8
• CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name High 8.7
• CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation High 8.7
• CVE-2024-45411 Twig has a possible sandbox bypass High 8.6
• CVE-2026-46634 Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-24425, GHSA-2q52-x2ff-qgfr, ROOT-APP-COMPOSER-CVE-2026-24425, UBUNTU-CVE-2026-24425, USN-8408-1.