crítica
CVE-2026-24425
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
GHSA8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Ubuntu (media).
Descripción
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| composer::GitHub Security Advisory Composer | twig/twig | 3.26.0 |
| composer::PHP Security Advisories Database | twig/twig | sin corrección indicada |
| debian 13 | php-twig | 3.27.0-0+deb13u1 |
| debian 14 | php-twig | 3.26.0-1 |
| rapidfort debian 12 | php-twig | 0:3.26.0-1, 0:3.27.0-0+deb13u1 |
| rapidfort debian 13 | php-twig | 0:3.26.0-1, 0:3.27.0-0+deb13u1 |
| rapidfort ubuntu 20.04 | php-twig | 0:3.26.0-1 |
| rapidfort ubuntu 22.04 | php-twig | 0:3.26.0-1 |
| rapidfort ubuntu 24.04 | php-twig | 0:3.26.0-1 |
| ubuntu 26.04 | php-twig | sin corrección indicada |
Referencias
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-24425.yaml
- https://github.com/twigphp/Twig
- https://github.com/twigphp/Twig/releases/tag/v3.26.0
- https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr
- https://nvd.nist.gov/vuln/detail/CVE-2026-24425
- https://symfony.com/blog/cve-2026-24425-possible-sandbox-bypass-when-using-a-source-policy
- https://symfony.com/cve-2026-24425
- https://ubuntu.com/security/notices/USN-8408-1