Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-24425: twig/twig library updated to stop attacks
CVE-2026-24425 · published 3 days ago
Summary
The Twig templating code used in PHP applications (including debian/php-twig, symfony/twig and related packages) has been patched to close a security gap. Continuing to run older versions could allow an attacker to run unwanted code on your server. Apply the latest package versions through your Composer or package manager as soon as possible.
What to do
- Update debian php-twig to version 3.26.0-1.
- Update debian php-twig to version 3.27.0-0+deb13u1.
- Update twig twig to version 3.26.0.
- Update twig twig/twig to version 3.26.0.
- Update twig twig/twig to version v3.11.3-p12007003+root.io.
- Update twig twig/twig to version v3.11.3-p12007004+root.io.
- Update twig twig/twig to version v3.11.3-p12007005+root.io.
- Update twigphp twig to version 3.26.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | php-twig |
< 3.27.0-0+deb13u1 Fix: upgrade to 3.27.0-0+deb13u1
|
| Debian:14 | debian | php-twig |
< 3.26.0-1 Fix: upgrade to 3.26.0-1
|
| – | symfony | twig |
>= 2.16.0, <= 2.16.1 >= 3.9.0, < 3.26.0 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* |
| composer | twig | twig |
>= 2.16.0, <= 2.16.1 >= 3.9.0, < 3.26.0 Fix: upgrade to 3.26.0
|
| Packagist | twig | twig/twig |
>= 2.16.0, <= 2.16.1 >= 3.9.0, < 3.26.0 Fix: upgrade to 3.26.0
|
| Ubuntu:25.10 | canonical | php-twig | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | php-twig | All versions |
| – | twigphp | twig | < 3.26.0 |
| Root:Composer | twig | twig/twig |
< v3.11.3-p12007003+root.io < v3.11.3-p12007004+root.io < v3.11.3-p12007005+root.io Fix: upgrade to v3.11.3-p12007003+root.io
|
Original advisory text
CVE-2026-24425 in twig/twig - Patched by Root
Root has patched CVE-2026-24425 in the twig/twig package for Root:Composer. Multiple fixed versions available.
References
- https://github.com/twigphp/Twig/releases/tag/v3.26.0 Vendor Advisory
- https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-24425 Vendor Advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-20...
- https://symfony.com/cve-2026-24425
- https://github.com/advisories/GHSA-2q52-x2ff-qgfr
- https://nvd.nist.gov/vuln/detail/CVE-2026-24425 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24425... Vendor Advisory
- https://github.com/twigphp/Twig Product
- https://ubuntu.com/security/CVE-2026-24425 Third Party Advisory
- https://symfony.com/blog/cve-2026-24425-possible-sandbox-bypass-when-using-a-sou... Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-24425 Third Party Advisory
- https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyint... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-693Protection Mechanism Failure
Timeline
Published2 Nov 2026
Updated4 Nov 2026
First seen20 May 2026
Sources
UBUNTU-CVE-2026-24425 · OSV
CVE-2026-24425 · NVD
GHSA-2q52-x2ff-qgfr · GHSA
GHSA-2q52-x2ff-qgfr · OSV
CVE-2026-24425 · MITRE
DEBIAN-CVE-2026-24425 · OSV
CVE-2026-24425 · OSV
Track software like this
Free during beta