Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-15 | 1 | Disclosure1 |
| 2026-07-17 | 1 | Patch1 |
🚨 HIGH: CVE-2026-49981 (CVSS 8.2) Twig PHP template engine sandbox bypass allows unauthorized filter/tag/function execution due to cached policy verdicts. Affects versions <3.27.0. Update to 3.27.0 immediately. #CVE #Vulnerability #PatchNow https://t.co/4ZNOu40ybC
Post summary
CVE-2026-49981 is a sandbox bypass in Twig PHP template engine; users are urged to update to patch 3.27.0 immediately.
CVE-2026-49981 Sandbox Bypass in Twig Template Engine Prior to Version 3.27.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-49981
Post summary
CVE‑2026‑49981 is disclosed as a sandbox bypass in Twig Template Engine prior to version 3.27.0, with no additional PoC, exploit, active use, or patch details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |