CVE-2026-47732 twigphp CVE debrief

Who should care

Users of Twig template language for PHP, particularly those using versions prior to 3.26.0, should be aware of this security vulnerability and take steps to mitigate it. This includes reviewing and restricting template author access to sensitive data, implementing additional security measures such as sandboxing and input validation, and tracking exceptions and retesting remediated assets.

Technical summary

The Twig template language for PHP has a security vulnerability (CVE-2026-47732) that allows a sandboxed template author to invoke __toString() on objects reachable in the render context through various language constructs, including conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0. Affected users should upgrade to the latest version and implement additional security measures.

Defensive priority

High priority due to the potential for arbitrary code execution.

Recommended defensive actions

• Upgrade to Twig version 3.26.0 or later
• Review and restrict template author access to sensitive data
• Implement additional security measures, such as sandboxing and input validation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and its fix. The vendor has released a patch and updated documentation. Evidence is limited, and defenders should verify affected scope and vendor guidance. Additional review of compensating controls and monitoring is recommended.

Official resources