Skip to content
OpenAdvisories

Package · Ubuntu

twig

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.0
    CVE-2026-49981

    Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

    Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandbox…

    twigphp Twig php-twig php-twig Debian Ubuntu Packagist
  • Medium 4.3
    CVE-2025-24374

    Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

    Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

    twigphp Twig php-twig twig/twig Debian Ubuntu Packagist