Publish GHSA-2q52-x2ff-qgfr

Author: advisory-database[bot]

advisories/github-reviewed/2026/06/GHSA-2q52-x2ff-qgfr/GHSA-2q52-x2ff-qgfr.json

@@ -0,0 +1,100 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2q52-x2ff-qgfr",
+  "modified": "2026-06-05T20:41:33Z",
+  "published": "2026-06-05T20:41:33Z",
+  "aliases": [
+    "CVE-2026-24425"
+  ],
+  "summary": "Twig: Possible sandbox bypass when using a source policy",
+  "details": "# Description\n\nWhen using the sandbox with a `SourcePolicyInterface`, Twig does not always apply the sandbox restriction that forbids non-`Closure` callbacks for callback-accepting filters.\n\nThe issue affects the `sort`, `filter`, `map`, and `reduce` filters.\n\nIn the affected versions, the runtime check that rejects non-`Closure` callbacks in sandbox mode does not use the current template `Source`. As a result, when the sandbox is enabled through a source policy instead of being enabled globally, Twig can incorrectly treat the current execution as non-sandboxed for these callback checks.\n\nThis can allow user-controlled templates to pass arbitrary PHP callables to callback-accepting filters even though the template is being sandboxed through a source policy.\n\nThe issue happens when all these conditions are met:\n\n- The sandbox is not enabled globally;\n- A `SourcePolicyInterface` enables the sandbox for the rendered template;\n- The template uses one of the `sort`, `filter`, `map`, or `reduce` filters;\n- The callback is not a `Closure`.\n\n# Resolution\n\nThe patch makes callback sandbox checks source-aware by propagating the current template `Source` to callback-accepting filters and using it when deciding whether sandbox restrictions apply.\n\n# Credits\n\nWe would like to thank XavLim and Wade Sparks for reporting the issue and Fabien Potencier for fixing the issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "twig/twig"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.16.0"
+            },
+            {
+              "last_affected": "2.16.1"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "twig/twig"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.9.0"
+            },
+            {
+              "fixed": "3.26.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24425"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-24425.yaml"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/twigphp/Twig"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://symfony.com/cve-2026-24425"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-693"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-05T20:41:33Z",
+    "nvd_published_at": "2026-05-20T14:16:38Z"
+  }
+}