CVE-2026-49981

Katalog CVE

CVSS 8.2 · High EPSS 0,36%

Kerentanan Protection Mechanism Failure pada symfony twig. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/twigphp/Twig/security/advisories/GHSA-529h-vh3j-85hq advisory vendor
• https://github.com/twigphp/Twig/commit/23eb6eb1267cb0d303b91eb5cff9b0c559c538a4 patch
• https://github.com/twigphp/Twig/releases/tag/v3.27.0 release notes