Incorrect Authorization Affecting twig/twig package, versions <3.27.0

twig/twig is a flexible, fast, and secure template language for PHP.

Affected versions of this package are vulnerable to Incorrect Authorization via cached template security decisions in the sandbox implementation. An attacker can bypass sandbox filter, tag, and function restrictions because the result of checkSecurity() is evaluated only once when a template instance is constructed and then cached in Environment::$loadedTemplates. Subsequent changes to sandbox state, security policy, or source-policy decisions are not re-evaluated for cached templates, allowing templates that were initially loaded outside the sandbox to execute filters, tags, and functions that would otherwise be prohibited by the current SecurityPolicy.

Note:

1. Method, property, and __toString() restrictions are not affected, as those checks are enforced dynamically at runtime.

2. Long-lived processes that reuse a single Environment across sandboxed and non-sandboxed renders are particularly affected, as templates loaded outside the sandbox can later be reused in sandboxed contexts without reapplying filter, tag, and function allow-list checks.

• GitHub Commit
• Symfony Blog