HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and Misclassification
May 20, 2026
#Security Advisories
#Symfony
CVE-2026-47732 Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
May 20, 2026
#Security Advisories
#Twig
Arbitrary PHP code execution via `_self.(
May 20, 2026
#Security Advisories
#Twig
Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments
May 20, 2026
#Security Advisories
#Twig
PHP code injection via `{% use %}` template name
May 20, 2026
#Security Advisories
#Twig
HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
May 20, 2026
#Security Advisories
#Twig
`{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
May 20, 2026
#Security Advisories
#Twig
Sandbox property and method bypass via object-destructuring assignment
May 20, 2026
#Security Advisories
#Twig
XSS in profiler HtmlDumper via unescaped template and profile names
May 20, 2026
#Security Advisories
#Twig