CyberRota Analysis
AI-GeneratedThe vulnerability affects the Twig template engine for PHP, allowing legacy functions to bypass sandbox restrictions due to improper handling of the current sandbox state. This could lead to unauthorized code execution within the sandboxed environment, posing a significant security risk. Organizations using affected versions prior to 3.27.0 should prioritize upgrading to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)