Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-47732: Twig template library may allow unauthorized code execution
CVE-2026-47732 · published 2 days ago
Summary
The Twig template component used by several PHP packages can be tricked into running code that an attacker supplies. This could let a malicious user take control of your web application or server. Update to the latest Twig versions provided by your package manager to close the gap.
What to do
- Update twig twig to version 3.26.0.
- Update debian php-twig to version 3.27.0-0+deb13u1.
- Update debian php-twig to version 3.26.0-1.
- Update twig twig/twig to version v3.11.3-p12007003+root.io.
- Update twig twig/twig to version v3.11.3-p12007004+root.io.
- Update twig twig/twig to version v3.11.3-p12007005+root.io.
- Update symfony twig to version 3.26.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:11 | debian | php-twig | All versions |
| Debian:12 | debian | php-twig | All versions |
| Debian:13 | debian | php-twig |
< 3.27.0-0+deb13u1 Fix: upgrade to 3.27.0-0+deb13u1
|
| composer | twig | twig |
<= 3.25.0 Fix: upgrade to 3.26.0
|
| Ubuntu:Pro:20.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | php-twig | All versions |
| Ubuntu:25.10 | canonical | php-twig | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | php-twig | All versions |
| – | twigphp | twig | < 3.26.0 |
| Debian:14 | debian | php-twig |
< 3.26.0-1 Fix: upgrade to 3.26.0-1
|
| – | symfony | twig |
< 3.26.0 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* |
| Root:Composer | twig | twig/twig |
< v3.11.3-p12007003+root.io < v3.11.3-p12007004+root.io < v3.11.3-p12007005+root.io Fix: upgrade to v3.11.3-p12007003+root.io
|
Original advisory text
CVE-2026-47732 in twig/twig - Patched by Root
Root has patched CVE-2026-47732 in the twig/twig package for Root:Composer. Multiple fixed versions available.
References
- https://security-tracker.debian.org/tracker/CVE-2026-47732 Vendor Advisory
- https://github.com/twigphp/Twig/releases/tag/v3.26.0 URL
- https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4 Vendor Advisory
- https://symfony.com/cve-2026-47732
- https://github.com/advisories/GHSA-pr2w-4gpj-cpq4
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-20...
- https://ubuntu.com/security/CVE-2026-47732 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-47732 Third Party Advisory
- https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9 Patch
- https://symfony.com/blog/cve-2026-47732-sandbox-multiple-tostring-policy-bypasse... Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47732... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-47732 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.1
High
Type
CWE-20Improper Input Validation
CWE-863Incorrect Authorization
Timeline
Published2 Nov 2026
Updated4 Nov 2026
First seen25 May 2026
Sources
DEBIAN-CVE-2026-47732 · OSV
UBUNTU-CVE-2026-47732 · OSV
CVE-2026-47732 · NVD
CVE-2026-47732 · MITRE
GHSA-pr2w-4gpj-cpq4 · GHSA
CVE-2026-47732 · OSV
Track software like this
Free during beta