Title: Twig de twigphp, Description: Versiones de Twig 2.16.x y 3.9.0 hasta 3.25.x contienen una vulnerabilidad de bypass de sandbox al usar una SourcePolicyInterface que permite a atacantes con capacidades de renderizado de plantillas pasar callables PHP arbitrarios a los filtros sort, filter, map y reduce. Los atacantes pueden explotar la verificación en tiempo de ejecución que no utiliza la fuente de plantilla actual para eludir las restricciones de sandbox y ejecutar código arbitrario cuando el sandbox está habilitado a través de una política de fuente en lugar de globalmente.

[{"vendor":"twigphp","product":"Twig","defaultStatus":"affected","repo":"https://github.com/twigphp/Twig","versions":[{"version":"3.9.0","lessThan":"3.26.0","versionType":"semver","status":"affected"},{"version":"2.16.*","versionType":"custom","status":"affected"}]}]

[{"vendor":"twigphp","product":"Twig","defaultStatus":"affected","repo":"https://github.com/twigphp/Twig","packageURL":"pkg:github/twigphp/Twig","versions":[{"version":"3.9.0","lessThan":"3.26.0","versionType":"semver","status":"affected"},{"version":"2.16.*","versionType":"custom","status":"affected"}]}]

{"timestamp":"2026-05-20T15:43:54.656189Z","id":"CVE-2026-24425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"twigphp","product":"Twig","defaultStatus":"affected","repo":"https://github.com/twigphp/Twig","versions":[{"version":"3.9.0","lessThan":"3.26.0","versionType":"semver","status":"affected"},{"version":"2.16.*","versionType":"custom","status":"affected"}]}]

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

OR
          *cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* versions from (including) 2.16.0 up to (including) 2.16.1
          *cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* versions from (including) 3.9.0 up to (excluding) 3.26.0

VulnCheck: https://github.com/twigphp/Twig/releases/tag/v3.26.0 Types: Product, Release Notes

VulnCheck: https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr Types: Vendor Advisory

VulnCheck: https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface Types: Third Party Advisory

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-693

https://github.com/twigphp/Twig/releases/tag/v3.26.0

https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr

https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface