CVE-2026-47732
HIGH SEVERITYCVSS Score & Metrics
Base Score
6.5 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability Description
Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-863
Source
GitHub
Vendor
composer
Product
twig/twig
External References
- https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47732.yaml
- https://github.com/twigphp/Twig/releases/tag/v3.26.0
- https://symfony.com/cve-2026-47732
- https://github.com/advisories/GHSA-pr2w-4gpj-cpq4
Discussion (0)
Add Comment
No comments yet. Be the first!