CVE-2026-49981 in Twig
Riassunto
di MITRE • 15/07/2026
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.