CVE-2026-46636: Twig: Sandbox method allowlist bypass via `Markup` subclass
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/php-twigto a version that resolves this vulnerability.Fixed in 3.27.0-0+deb13u1Fixed in 3.28.0-1 - Upgrade
Upgrade
Twig (Twig")to a version that resolves this vulnerability.Fixed in 3.27.0
Event History
Frequently Asked Questions
Which applications are exposed to this bypass?
Applications are exposed only if they render sandboxed Twig templates and pass an instance of a class derived from Twig\Markup into those templates. This commonly occurs when an application uses such an object to designate HTML as safe.
What access does an attacker need to exploit it?
An attacker needs the ability to cause method calls in a sandboxed template against a supplied Markup-derived object. Public methods of that subclass can then be invoked even when they are absent from the configured allowedMethods list.
Are default sandbox method restrictions sufficient to prevent exploitation?
No. For instances of Twig\Markup and its subclasses, the affected check unconditionally allowed method calls, bypassing the configured allowedMethods restrictions.
What can be done before upgrading?
Do not pass objects derived from Twig\Markup into sandboxed templates. Where feasible, pass only the required string or data values instead of the object, preventing template authors from accessing the subclass's public methods.
How can I determine whether an application is affected?
Review sandboxed template rendering paths for values that are instances of Twig\Markup subclasses, and identify the installed Twig version. Versions from 1.0.0 through versions before 3.27.0 are affected.