Twig
Vendor:
First CVE: Dec 31, 2001 · Active for 24 years
25
Total CVEs
More Total CVEs than 95% of tracked products
3.6
Avg CVEs / Year
Higher CVE frequency than 83% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Twig over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 2001
24 years ago
Most Recent CVE
Jul 14, 2026
10 days ago
CVE Severity & Scoring
Twig25 CVEs
36%
28%
32%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network24 (96.0%)
Unknown1 (4.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low23 (92.0%)
High1 (4.0%)
Unknown1 (4.0%)
User Interaction
None21 (84.0%)
Unknown1 (4.0%)
Required3 (12.0%)
Privileges Required
Low11 (44.0%)
High0 (0.0%)
None13 (52.0%)
Unknown1 (4.0%)
Top CVEs
Signals from CVEs in this product scope (25 CVEs).
25 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-46633CRITICAL Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quote | Jul 14, 2026 | 9.8 | 43 | NO | NO |
CVE-2026-46640HIGH Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a Macro | Jul 14, 2026 | 8.8 | 39 | NO | NO |
CVE-2026-46634CRITICAL Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall out | Jul 14, 2026 | 9.8 | 39 | NO | NO |
CVE-2026-24425CRITICAL Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities t | May 20, 2026 | 9.9 | 39 | NO | NO |
CVE-2026-48807CRITICAL Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated | Jul 14, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-48805CRITICAL Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow() | Jul 14, 2026 | 9.1 | 37 | NO | NO |
CVE-2026-48806CRITICAL Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stri | Jul 14, 2026 | 9.1 | 36 | NO | NO |
CVE-2022-23614CRITICAL Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrar | Feb 4, 2022 | 9.8 | 36 | NO | NO |
CVE-2026-49981HIGH Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can rema | Jul 14, 2026 | 8.2 | 35 | NO | NO |
CVE-2026-48808HIGH Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::ch | Jul 14, 2026 | 7.5 | 33 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (25 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (25 CVEs).
Media Mentions
Signals from CVEs in this product scope (25 CVEs).
Top CNAs Publishing CVEs For Twig
Top CWEs
Versions
No cataloged versions.