These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A security issue was found in Twig, a template language for PHP. The per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders. This allows a later sandboxed render to reuse a template that was originally checked with a different or empty policy. The issue is fixed in version 3.27.0. Affec [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:17:05.427Z and has not been modified since then. This vulnerability affects users of Twig template language for PHP, particularly those using versions prior to 3.27.0. The column filter in Twig passes the active sandbox state as a boolean but does not forward the current Source to SandboxExten [truncated]
CVE-2026-48807 is a vulnerability in the Twig template language for PHP, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This HIGH severity issue affects developers and administrators using Twig prior to version 3.27.0. The vulnerability was published on 2026-07-14T22:17:05.090Z and has not been modified since then. The fix is included in version 3.27.0.
The CVE-2026-48806 vulnerability is related to the Twig template language for PHP. Affected versions prior to 3.27.0 have a vulnerability in ArrayExpression that allows dynamic mapping keys to be coerced to strings without proper guarding. This could potentially lead to code execution via __toString() method invocation. The issue is fixed in version 3.27.0. Users of Twig template language for PHP, version [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:17:04.773Z and has not been modified since then. Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as tw [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:16:59.667Z and has not been modified since then. This vulnerability affects Twig template language for PHP, particularly versions prior to 3.26.0. The issue allows a sandboxed template author to invoke __toString() on objects reachable in the render context through various language constructs. [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:16:59.530Z and has not been modified since then. This vulnerability affects Twig versions between 3.0.0 and 3.26.0, allowing attacker-controlled template or profile names to inject arbitrary HTML. The issue is fixed in version 3.26.0. Developers and administrators should review and apply the p [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:16:56.840Z and has not been modified since then. This vulnerability affects Twig template language for PHP, specifically versions 3.15.0 to 3.25.0. The vulnerability allows an attacker to inject and execute arbitrary PHP code due to improper validation of dynamic attribute syntax in MacroRefer [truncated]
CVE-2026-46639 is a vulnerability in the Twig template language for PHP, specifically in the object-destructuring assignment feature. From version 3.24.0 until 3.26.0, the sandbox argument in CoreExtension::getAttribute() is hardcoded to false, which disables property and method policy checks. This allows an attacker with write access to a sandboxed Twig template to read public properties or invoke public [truncated]
A security bypass vulnerability exists in Twig template language for PHP, versions prior to 3.26.0. The {% sandbox %}{% include %} construct can include a template previously loaded outside the sandbox without re-invoking checkSecurity(), potentially allowing the cached template to use denied tags, filters, and functions. This issue is fixed in version 3.26.0. Users of Twig template language for PHP, part [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T22:16:56.410Z and has not been modified since then. Twig template language for PHP prior to version 3.26.0 has several filters in twig/markdown-extra and twig/cssinliner-extra registered with is_safe => [all], causing Twig to treat plain text or HTML output as safe in HTML, JavaScript, CSS, URL, [truncated]
The CVE record for CVE-2026-46634 was published on 2026-07-14T22:16:56.130Z. This vulnerability affects Twig template language for PHP, specifically versions between 3.9.0 and 3.26.0. The issue is related to the template_from_string() function, which can allow a sandboxed template to render an inner template without proper security policy enforcement. Users of Twig should review their deployments and ensu [truncated]
CVE-2026-46633 is a high-severity vulnerability in Twig, a template language for PHP. The vulnerability exists in the Compiler::string() method, which does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal. This allows a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. The C [truncated]
The CVE record for CVE-2026-46629 was published on 2026-07-14T22:16:55.860Z and has not been modified since then. The vulnerability affects Twig template language for PHP prior to version 3.26.0, allowing a template to allocate many ICU formatter objects that remain pinned for the lifetime of the Twig Environment. This issue is fixed in version 3.26.0. Users of affected systems should review and update th [truncated]
The CVE-2026-46628 record describes a security vulnerability in the Twig template language for PHP, specifically in the deprecated spaceless filter prior to version 3.26.0. This filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. The vulnerability allows attackers to inject malicious HTML code. The issu [truncated]
CVE-2026-46627 is a high-severity vulnerability in the Twig template language for PHP. The vulnerability allows untrusted templates to cause resource exhaustion, consuming CPU, memory, or wall-clock time, even under the strictest allow-list. This issue was addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion. Affected users should review and update their [truncated]