VDB
Sign up
LOW

GHSA-vcc8-phrv-43wj

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

Quick fix

GHSA-vcc8-phrv-43wj — twig/twig: upgrade to the fixed version with the command below.

composer require twig/twig:^3.26.0

Details

### Description

The `column` filter passes its input straight to PHP's native `array_column()`. When the array elements are objects, `array_column()` reads `$obj->$name` (and `$obj->$index`) directly, including invoking `__get`/`__isset`. Because this property read happens entirely in PHP native code and never reaches `CoreExtension::getAttribute()`, `SandboxExtension::checkPropertyAllowed()` is never consulted.

An untrusted template author with `column` in their `allowedFilters` list can therefore read any public or magic property of any object reachable in the render context, regardless of the `SecurityPolicy` `allowedProperties` list. This is a variant of CVE-2024-51755 / GHSA-jjxq-ff2g-95vh that the `ArrayAccess`-focused fix did not cover.

### Resolution

The `column` filter now routes object property reads through the sandbox-aware attribute accessor so the property allowlist is enforced.

### Credits

Twig: would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/twig/twig
Introduced in: 0Fixed in: 3.26.0
Fixcomposer require twig/twig:^3.26.0

References