CyberRota Analysis
AI-GeneratedTwig versions prior to 3.27.0 are vulnerable due to a flaw in the column filter that allows unauthorized access to public or magic properties, bypassing the sandbox policy. This can lead to potential information disclosure, making it critical for developers using Twig in their PHP applications to upgrade to version 3.27.0 or later to mitigate the risk. Organizations utilizing Twig for templating should prioritize this update to protect against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)