A security vulnerability has been identified in Twig, a popular tool used to build dynamic content for many websites. The flaw impacts Twig versions 2.16.x, as well as all versions from 3.9.0 through 3.25.x. This issue is a bypass of Twig's built-in sandbox security feature, which is designed to stop untrusted template code from running harmful operations on a site. The vulnerability only affects sites that use Twig with the sandbox enabled via a source policy (rather than the default global sandbox setting). If an attacker has access to template rendering functions on an affected site, they can exploit this flaw to run their own PHP code on the site's server. Sites that do not use Twig, run an unaffected Twig version, or do not use the source policy sandbox configuration are not impacted by this issue.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-24425
