CVE-2026-47732: Symfony Twig

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

Affected products

• Symfony Twig: before 3.26.0 (fixed in 3.26.0)

Published 2026-07-14. Last modified 2026-07-16.