Twig remote code execution in templates

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-7809 · ADVISORY
• twigphp/Twig#1759 · WEB
• twigphp/Twig commit 30be077 · WEB
• FriendsOfPHP/security-advisories · WEB
• twigphp/Twig · PACKAGE
• symfony.com/blog/security-release-twig-1-20-0 · WEB
• openwall.com/lists/oss-security/2015/08/21/3 · WEB
• openwall.com/lists/oss-security/2015/10/11/2 · WEB
• symfony.com/blog/security-release-twig-1-20-0 · WEB
• debian.org/security/2015/dsa-3343 · WEB
• fabpot/Twig commit 30be077

More vulnerabilities in twig/twig

• CVE-2026-49981HIGH 8.2Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Templ…
• CVE-2026-48808HIGH 7.5Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward th…
• CVE-2026-48807CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join a…
• CVE-2026-48806CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allow…
• CVE-2026-48805CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sand…