CVE-2026-46635CWE-863

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

Medium · published July 14, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
25.0
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00331 · 25.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-14T21:12Z
EPSS history
Timeline
  • 14 JUL 21:12Z
    Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
    cvelistv5