Twig

This hub aggregates every CVE we track for Twig, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Twig.

• CVE-2026-24425Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface8.8May 20, 2026
• CVE-2025-24374Twig fixes a security issue where escaping was missing when using null coalesce operator (??)4.3Jan 29, 2025
• CVE-2024-51754Unguarded calls to __toString() when nesting an object into an array in Twig2.2Nov 6, 2024
• CVE-2024-51755Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig2.2Nov 6, 2024
• CVE-2024-45411Twig has a possible sandbox bypass8.5Sep 9, 2024
• CVE-2023-46734Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters6.1Nov 10, 2023
• CVE-2022-39261Twig may load a template outside a configured directory when using the filesystem loader7.5Sep 28, 2022
• CVE-2022-23614Code injection in Twig8.8Feb 4, 2022
• CVE-2019-9942A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed...3.7Mar 23, 2019
• CVE-2018-13818Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the r...9.8Jul 10, 2018
• CVE-2015-7809The displayBlock function Template.php in Sensio Labs Twig before 1.20.0, when Sandbox mode is enabled, allows remote attackers to execute arbitrary code via the _self variable in a template.6.8Nov 6, 2015
• CVE-2001-1537The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication info...7.5Jul 14, 2005
• CVE-2000-1166Twig webmail system does not properly set the "vhosts" variable if it is not configured on the site, which allows remote attackers to insert arbitrary PHP (PHP3) code by specifying an alternate vho...7.5Jun 25, 2002
• CVE-2001-1361Vulnerability in The Web Information Gateway (TWIG) 2.7.1, possibly related to incorrect security rights and/or the generation of mailto links.7.5Jun 11, 2002
• CVE-2001-1348TWIG 2.6.2 and earlier allows remote attackers to perform unauthorized database operations via a SQL injection attack on the id parameter.7.5May 3, 2002