Improper access control in Twig - CVE-2026-47732

Detailed vulnerability description

The vulnerability allows a remote user to bypass sandbox policy restrictions and invoke unauthorized __toString() methods.

The vulnerability exists due to improper access control in SandboxNodeVisitor and related string coercion handling when rendering sandboxed templates that trigger implicit string coercion on Stringable objects. A remote user can craft a sandboxed template that uses unguarded language constructs to bypass sandbox policy restrictions and invoke unauthorized __toString() methods.

The issue affects multiple Twig constructs that coerce Stringable operands to strings without first consulting the sandbox policy, including comparisons, tests, conditional expressions, dynamic attribute names, template-loading expressions, spread arguments, the do tag, and the range operator.

How to mitigate CVE-2026-47732

Sources

• https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4
• https://github.com/twigphp/Twig/security/advisories