{"id":"CVE-2026-24425","aliases":["GHSA-2q52-x2ff-qgfr"],"url":"https://o3.security/vulnerability/CVE-2026-24425","summary":"Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface","details":"# Description\n\nWhen using the sandbox with a `SourcePolicyInterface`, Twig does not always apply the sandbox restriction that forbids non-`Closure` callbacks for callback-accepting filters.\n\nThe issue affects the `sort`, `filter`, `map`, and `reduce` filters.\n\nIn the affected versions, the runtime check that rejects non-`Closure` callbacks in sandbox mode does not use the current template `Source`. As a result, when the sandbox is enabled through a source policy instead of being enabled globally, Twig can incorrectly treat the current execution as non-sandboxed for these callback checks.\n\nThis can allow user-controlled templates to pass arbitrary PHP callables to callback-accepting filters even though the template is being sandboxed through a source policy.\n\nThe issue happens when all these conditions are met:\n\n- The sandbox is not enabled globally;\n- A `SourcePolicyInterface` enables the sandbox for the rendered template;\n- The template uses one of the `sort`, `filter`, `map`, or `reduce` filters;\n- The callback is not a `Closure`.\n\n# Resolution\n\nThe patch makes callback sandbox checks source-aware by propagating the current template `Source` to callback-accepting filters and using it when deciding whether sandbox restrictions apply.\n\n# Credits\n\nWe would like to thank XavLim and Wade Sparks for reporting the issue and Fabien Potencier for fixing the issue.","published":"2026-05-20T13:45:02.413Z","modified":"2026-10-10T02:30:47.913586350Z","cvss":null,"epss":{"score":0.00758,"percentile":0.52435,"asOf":"2026-08-20"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"twig/twig","fixedVersion":null},{"ecosystem":"Packagist","name":"twig/twig","fixedVersion":"3.26.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24425.json"},{"type":"ADVISORY","url":"https://github.com/twigphp/Twig/releases/tag/v3.26.0"},{"type":"ADVISORY","url":"https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24425"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface"},{"type":"PACKAGE","url":"https://github.com/twigphp/Twig"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-24425.yaml"},{"type":"WEB","url":"https://symfony.com/cve-2026-24425"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-10T02:30:47.913586350Z"}}