DEBIAN-CVE-2026-24425

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-24425

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24425.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-24425

Upstream

CVE-2026-24425

Published

2026-05-20T14:16:38Z

Modified

2026-08-27T23:05:47Z

Severity

9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

References

https://security-tracker.debian.org/tracker/CVE-2026-24425

Affected packages

Debian:13 / php-twig

Package

Name: php-twig
Purl: pkg:deb/debian/php-twig?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.27.0-0+deb13u1

Affected versions

3.*

3.20.0-2

3.21.1-1

3.21.1-2

3.21.1-3

3.22.0-1

3.22.0-2

3.22.1-1

3.22.1-2

3.22.1-3

3.22.2-1

3.22.2-2

3.23.0-1

3.23.0-2

3.24.0-1

3.26.0-0+deb13u1

3.26.0-1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24425.json"

Debian:14 / php-twig