Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔐 CVE-2026-46635: Sandbox property allowlist bypass via the `column` filter (array_column on objects) ➡️ https://symfony.com/blog/cve-2026-46635-sandbox-property-allowlist-bypass-via-the-column-filter-array-column-on-objects
Post summary
The post announces CVE-2026-46635, detailing a sandbox allowlist bypass via the `column` filter (`array_column` on objects), but provides no PoC, exploit, patch, or evidence of active exploitation.
🔵 Twig, Sandbox Property Allowlist Bypass, #CVE-2026-46635 (Low) https://dailycve.com/twig-sandbox-property-allowlist-bypass-cve-2026-46635-low/
Post summary
The text announces the discovery of CVE-2026-46635, a low‑severity Sandbox Property Allowlist bypass in Twig, without providing technical or exploit details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |