CVE-2026-49981CWE-693CWE-863broken-access-control

CVE-2026-49981

High · published July 15, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
28.8
In the wild
Unconfirmed
What it is

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.8th percentile
Weaknesses
CWE-693 · Protection Mechanism Failure; CWE-863 · Incorrect Authorization
Published
2026-07-15T02:17Z
Affected products (1)
ProductVersionsFixed in
symfony/twig< 3.27.03.27.0
References (3)
https://github.com/twigphp/Twig/commit/23eb6eb1267cb0d303b91eb5cff9b0c559c538a4 · [email protected]https://github.com/twigphp/Twig/releases/tag/v3.27.0 · [email protected]https://github.com/twigphp/Twig/security/advisories/GHSA-529h-vh3j-85hq · [email protected]
EPSS history
Timeline
  • 14 JUL 21:26Z
    Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
    cvelistv5