---
title: "symfony twig vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/symfony/twig
type: product
description: "symfony twig has 25 published CVEs, 0 in CISA KEV and 2 with public exploits."
updated: 2026-07-14
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# symfony twig vulnerabilities

Vendor: [symfony](https://radicalnotion.ai/vendor/symfony)

- **Published CVEs:** 25
- **In CISA KEV:** 0
- **With a public exploit:** 2
- **With a patch:** 24
- **Average CVSS:** 7.0
- **First CVE:** 2005-07-14
- **Latest CVE:** 2026-07-14

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 3 |
| High | 12 |
| Medium | 9 |
| Low | 1 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-693](https://radicalnotion.ai/cwe/cwe-693) | Protection Mechanism Failure | 10 |
| [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 3 |
| [CWE-863](https://radicalnotion.ai/cwe/cwe-863) | Incorrect Authorization | 2 |
| [CWE-116](https://radicalnotion.ai/cwe/cwe-116) | Improper Encoding or Escaping of Output | 2 |
| [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 1 |
| [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 1 |
| [CWE-770](https://radicalnotion.ai/cwe/cwe-770) | Allocation of Resources Without Limits or Throttling | 1 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2015 | 1 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 1 |
| 2019 | 1 |
| 2020 | 0 |
| 2021 | 0 |
| 2022 | 2 |
| 2023 | 0 |
| 2024 | 1 |
| 2025 | 0 |
| 2026 | 18 |

## Affected versions (top 24 of 34)

| Version | Kind | CVEs |
| --- | --- | --- |
| \< 3.26.0 | range | 8 |
| \< 3.27.0 | range | 5 |
| 3.9.0 \<= v \< 3.26.0 | range | 2 |
| \< 1.38.0 | range | 1 |
| \< 2.4.4 | range | 1 |
| \<= 1.19.0 | range | 1 |
| \<= 2.7.4 | range | 1 |
| 1.0.0 \<= v \< 1.44.7 | range | 1 |
| 1.0.0 \<= v \< 1.44.8 | range | 1 |
| 2.0.0 \<= v \< 2.14.11 | range | 1 |
| 2.0.0 \<= v \< 2.15.3 | range | 1 |
| 2.0.0 \<= v \< 2.16.1 | range | 1 |
| 3.26.0 | patched | 13 |
| 3.27.0 | patched | 5 |
| 1.38.0 | patched | 1 |
| 1.44.7 | patched | 1 |
| 1.44.8 | patched | 1 |
| 2.14.11 | patched | 1 |
| 2.15.3 | patched | 1 |
| 2.16.1 | patched | 1 |
| 2.4.4 | patched | 1 |
| 2.7.0 | patched | 1 |
| 3.14.0 | patched | 1 |
| 3.3.8 | patched | 1 |

## CVEs

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-48807 | Twig: Sandbox \`\_\_toString()\` policy bypass via \`Traversable\` in \`join\` and \`replace\` filters | high | 7.1 | No | No | Yes |
| CVE-2026-48806 | Twig: Sandbox \`\_\_toString()\` policy bypass via dynamic mapping keys | high | 7.1 | No | No | Yes |
| CVE-2026-48808 | Twig: Sandbox property allowlist bypass via the \`column\` filter under \`SourcePolicyInterface\` | medium | 6.0 | No | No | Yes |
| CVE-2026-48805 | Twig: Sandbox state regression in deprecated internal wrappers in \`src/Resources/core.php\` | medium | 5.3 | No | No | Yes |
| CVE-2026-49981 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached \`Template\` | high | 8.7 | No | No | Yes |
| CVE-2026-46637 | Twig: HTML-output filters in twig/\* extras incorrectly declared \`is\_safe =\> \['all'\]\` | medium | 5.1 | No | No | Yes |
| CVE-2026-46638 | Twig: \`{% sandbox %}{% include %}\` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) | medium | 6.0 | No | No | Yes |
| CVE-2026-46640 | Twig: Arbitrary PHP code execution via \`\_self.( )\` macro-reference compilation | high | 8.7 | No | No | Yes |
| CVE-2026-46629 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments | medium | 5.3 | No | No | Yes |
| CVE-2026-47730 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | medium | 5.1 | No | No | Yes |
| CVE-2026-46628 | Twig: The \`spaceless\` filter implicitly marks its output as safe | medium | 5.1 | No | Yes | Yes |
| CVE-2026-46634 | Twig: \`template\_from\_string()\` escapes a SourcePolicy-driven sandbox via synthesized template name | high | 7.7 | No | No | Yes |
| CVE-2026-46627 | Twig: Sandbox resource exhaustion via unbounded \`for\` / \`range()\` | high | 7.1 | No | No | Yes |
| CVE-2026-46633 | Twig: PHP code injection via \`{% use %}\` template name | critical | 9.3 | No | No | Yes |
| CVE-2026-46639 | Twig: Sandbox property and method bypass via object-destructuring assignment | high | 8.7 | No | No | Yes |
| CVE-2026-46635 | Twig: Sandbox property allowlist bypass via the \`column\` filter (array\_column on objects) | medium | 5.3 | No | No | Yes |
| CVE-2026-47732 | Twig Sandbox: multiple \`\_\_toString()\` policy bypasses via unguarded string coercion points | high | 7.1 | No | No | Yes |
| CVE-2026-24425 | Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface | high | 8.7 | No | No | Yes |
| CVE-2024-45411 | Twig has a possible sandbox bypass | medium | 5.8 | No | No | Yes |
| CVE-2022-39261 | Twig may load a template outside a configured directory when using the filesystem loader | high | 7.5 | No | No | Yes |
| CVE-2022-23614 | Code injection in Twig | critical | 9.8 | No | No | Yes |
| CVE-2019-9942 | Twig Sandbox Information Disclosure | low | 3.7 | No | No | Yes |
| CVE-2018-13818 | - | critical | 9.8 | No | Yes | Yes |
| CVE-2015-7809 | Twig remote code execution in templates | high | 8.1 | No | No | Yes |
| CVE-2001-1537 | - | high | 7.5 | No | No | No |

## Frequently asked questions

### How many CVEs does symfony twig have?

symfony twig has 25 published CVE records since 2005.

### How many symfony twig CVEs are in CISA KEV?

None of symfony twig's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for symfony twig vulnerabilities?

Yes — 2 of symfony twig's CVEs have a known public exploit.

### Which versions of symfony twig are affected?

34 distinct symfony twig versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in symfony twig CVEs?

symfony twig's CVEs most often map to these CWE weakness types: CWE-693 (Protection Mechanism Failure), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-863 (Incorrect Authorization), CWE-116 (Improper Encoding or Escaping of Output).

### How many critical symfony twig vulnerabilities are there?

symfony twig has 3 critical and 12 high-severity CVEs.

### What is the average severity of symfony twig CVEs?

The average CVSS base score across symfony twig's scored CVEs is 7.0.

## Other products from this vendor

- [symfony](https://radicalnotion.ai/vendor/symfony/symfony) (115 CVEs)
- [symfony/symfony](https://radicalnotion.ai/vendor/symfony/symfony-symfony) (96 CVEs)
- [symfony/security-http](https://radicalnotion.ai/vendor/symfony/symfony-security-http) (19 CVEs)
- [symfony/security](https://radicalnotion.ai/vendor/symfony/symfony-security) (17 CVEs)
- [symfony/http-foundation](https://radicalnotion.ai/vendor/symfony/symfony-http-foundation) (14 CVEs)
- [security-http](https://radicalnotion.ai/vendor/symfony/security-http) (11 CVEs)
- [ux](https://radicalnotion.ai/vendor/symfony/ux) (10 CVEs)
- [symfony/http-kernel](https://radicalnotion.ai/vendor/symfony/symfony-http-kernel) (8 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/symfony/twig). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.