A security vulnerability has been found in Twig, a tool used by many websites to render dynamic page content. The flaw affects Twig versions 2.16.x and 3.9.0 through 3.25.x.
If your site uses Twig with sandbox security enabled via a source policy (rather than a global site-wide sandbox setting), an attacker with the ability to edit or add site templates could exploit this flaw to run unauthorized code on your hosting account.
The vulnerability exploits a gap in Twig's runtime security check, which fails to properly verify the source of the code being processed. This lets attackers bypass the sandbox's intended protections by passing arbitrary PHP code to the sort, filter, map, and reduce template filters, allowing them to execute code that the sandbox is designed to block.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-24425
