AIKIDO-2026-490805

TL;DR

The unserialize Twig filter in the twig-view plugin deserializes input without restricting which PHP classes may be instantiated. When a template applies this filter to attacker-controlled data, the deserialization can be abused as a remote-code-execution gadget through crafted serialized objects. This lets an attacker trigger unintended object instantiation and magic methods while a view is rendered. The fix disables object instantiation by passing ['allowed_classes' => false] to unserialize and deprecates the serialize and unserialize filters.