CVE-2026-47732

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Incorrect Authorization pada symfony twig. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/twigphp/Twig/security/advisories/GHSA-pr2w-4gpj-cpq4 advisory vendor
• https://github.com/twigphp/Twig/commit/447d0b2331e01b8fc6e08119ac984e1ef50caef9 patch
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 release notes