Medium severity6.5OSV Advisory· Published Jul 14, 2026· Updated Jul 16, 2026
CVE-2026-47732
CVE-2026-47732
Description
Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
twig/twigPackagist | < 3.26.0 | 3.26.0 |
Affected products
1Patches
Vulnerability mechanics
References
6- github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9nvdPatch
- github.com/advisories/GHSA-pr2w-4gpj-cpq4ghsaADVISORY
- github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47732.yamlghsaWEB
- github.com/twigphp/Twig/releases/tag/v3.26.0nvdRelease NotesWEB
- symfony.com/cve-2026-47732ghsaWEB
News mentions
0No linked articles in our index yet.