CVE-2026-46639 | BDVDB-2026-347759 Detail

Description#

Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. This issue is fixed in version 3.26.0.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-14Record published in the CVE List.
2. Version 22026-07-15Most recent update recorded in the CVE List.