Affected versions
Twig versions <3.26.0 are affected by this security issue.
The issue has been fixed in Twig 3.26.0.
Description
The column filter passes its input straight to PHP's native
array_column(). When the array elements are objects, array_column()
reads $obj->$name (and $obj->$index) directly, including invoking
__get/__isset. Because this property read happens entirely in PHP
native code and never reaches CoreExtension::getAttribute(),
SandboxExtension::checkPropertyAllowed() is never consulted.
An untrusted template author with column in their allowedFilters
list can therefore read any public or magic property of any object
reachable in the render context, regardless of the SecurityPolicy
allowedProperties list. This is a variant of CVE-2024-51755 /
GHSA-jjxq-ff2g-95vh that the ArrayAccess-focused fix did not cover.
Resolution
The column filter now routes object property reads through the
sandbox-aware attribute accessor so the property allowlist is enforced.
Credits
We would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.