A security flaw has been identified in the Twig template system, a common tool used to build dynamic content for websites. This issue impacts Twig versions 2.16.x, and all versions from 3.9.0 up to 3.25.x.
The vulnerability is a sandbox bypass. Twig’s sandbox feature is designed to stop untrusted templates from running risky operations. Attackers who can make your site process custom Twig templates can exploit this flaw to get around the sandbox’s protections.
When successfully exploited, this flaw lets attackers run arbitrary code on your site, but only in cases where the sandbox is enabled via a source policy rather than turned on globally for all templates. This gives attackers the ability to take unapproved actions on your site.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-24425