CVE-2026-24425: symfony twig

csirt@kutim:~/threat-intel/cve/CVE-2026-24425

CVSS 9.9 · Critical EPSS 0,76%

Kerentanan Protection Mechanism Failure pada symfony twig. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to sort, filter, map, and reduce filters. Attackers can exploit the runtime check that fails to use the current template source to bypass sandbox restrictions and execute arbitrary code when the sandbox is enabled through a source policy rather than globally.

Rincian

Terbit di NVD: 20 Mei 2026
Terakhir diubah: 8 Oktober 2026
Status NVD: Analyzed
CVSS 3.1: 9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-693: Protection Mechanism Failure
EPSS (30 hari): 0,76% peluang dieksploitasi; lebih tinggi dari 54,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
symfony	twig	Versi 2.16.0 hingga 2.16.1
symfony	twig	Versi 3.9.0 hingga sebelum 3.26.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/twigphp/Twig/security/advisories/GHSA-2q52-x2ff-qgfr advisory vendor
https://www.vulncheck.com/advisories/twig-x-x-sandbox-bypass-via-sourcepolicyinterface advisory pihak ketiga
https://github.com/twigphp/Twig/releases/tag/v3.26.0 product · release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.