CVE-2026-46635: Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)
Description
The column filter passes its input straight to PHP's native arraycolumn(). When the array elements are objects, arraycolumn() reads $obj->$name (and $obj->$index) directly, including invoking get/isset. Because this property read happens entirely in PHP native code and never reaches CoreExtension::getAttribute(), SandboxExtension::checkPropertyAllowed() is never consulted.
An untrusted template author with column in their allowedFilters list can therefore read any public or magic property of any object reachable in the render context, regardless of the SecurityPolicy allowedProperties list. This is a variant of CVE-2024-51755 / GHSA-jjxq-ff2g-95vh that the ArrayAccess-focused fix did not cover.
Resolution
The column filter now routes object property reads through the sandbox-aware attribute accessor so the property allowlist is enforced.
Credits
Twig: would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Other sources
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP arraycolumn(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/twig/twigto a version that resolves this vulnerability.Fixed in 3.26.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.26.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46635?
The severity of CVE-2026-46635 is rated at 47.
What software is affected by CVE-2026-46635?
CVE-2026-46635 affects the composer/twig/twig software.
How does CVE-2026-46635 impact PHP object properties?
CVE-2026-46635 allows access to PHP object properties directly, including invoking __get/__isset methods.
How do I fix CVE-2026-46635?
To fix CVE-2026-46635, update to the latest version of composer/twig/twig that addresses this vulnerability.
When was CVE-2026-46635 published?
CVE-2026-46635 was published on May 21, 2026.