Twigphp Twig vulnerabilities

CVE-2026-46635 [MEDIUM] CWE-863 CVE-2026-46635: Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in t

CVE-2025-24374 [MEDIUM] CWE-74 CVE-2025-24374: Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

CVE-2024-51754 [LOW] CWE-668 CVE-2024-51754: Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are ad

CVE-2024-51755 [LOW] CWE-668 CVE-2024-51755: Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like o Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All use