CVE-2026-48805

Analyzed Analyzed - Analysis Complete

Sandbox Bypass in Twig Template Engine

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48805

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Twig, a PHP template language. In versions before 3.27.0, deprecated internal wrappers in core.php fail to pass the current sandbox state to certain functions. This allows legacy calls like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox restrictions on callable functions.

Detection Guidance

This vulnerability affects Twig versions prior to 3.27.0. To detect it, check your Twig version with: composer show twig/twig. If the version is below 3.27.0, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute restricted functions within a sandboxed environment. This may lead to unauthorized code execution or data manipulation if the application relies on Twig's sandbox for security.

Compliance Impact

The vulnerability allows bypassing sandbox restrictions in Twig, which could lead to unauthorized code execution or data access. This may impact compliance with GDPR (data protection) or HIPAA (health data security) if exploited to access or manipulate sensitive data.

Mitigation Strategies

Upgrade Twig to version 3.27.0 or later immediately. Use: composer require twig/twig:^3.27.0. Review legacy calls like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to ensure they are not bypassing sandbox restrictions.

Hi! I’m here to help you understand CVE-2026-48805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70