GHSA-529H-VH3J-85HQ Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`

Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...

PT-2026-55096

Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...

PT-2026-55213

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.27.0 Description In the template language for PHP, the allow-list verdict for filters, tags, and functions is computed during the construction of a Template instance and cached. This allows a sandboxed render to reuse ...