CVE-2026-49981 Details

A vulnerability exists in Twig, a template language for PHP, prior to version 3.27.0, allowing a bypass of the sandbox security policy. The issue arises because the security allow-list for filters, tags, and functions is determined when a template is first loaded and can be cached. This cached information may not reflect subsequent changes in the sandbox state, leading to a situation where a template can be reused in a sandboxed context without the appropriate security checks. The vulnerability is particularly concerning in environments that share a single Twig environment between different requests, such as with PHP-FPM or certain message queue consumers.

Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.