CVE-2026-48806

Analyzed Analyzed - Analysis Complete

Twig Template Engine Dynamic Mapping Key String Coercion Vulnerability

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48806

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Before version 3.27.0, it had a flaw where ArrayExpression did not properly protect dynamic mapping keys converted to strings. This allowed PHP to call __toString() on Stringable objects used as keys without checking SandboxExtension::ensureToStringAllowed().

Detection Guidance

Detect Twig versions below 3.27.0 using commands like 'composer show twig/twig' or 'php -r "echo Twig\TwigBundle\TwigBundle::VERSION;"'. Check application dependencies for outdated Twig packages.

Impact Analysis

An attacker could exploit this to execute unintended code or access sensitive data by manipulating string conversion in Twig templates. This may lead to remote code execution or data breaches depending on the application's context.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Non-compliance risks include fines and legal penalties.

Mitigation Strategies

Upgrade Twig to version 3.27.0 or later immediately. Update Composer dependencies with 'composer update twig/twig'. Review custom extensions for unsafe Stringable object usage in mapping keys.

Hi! I’m here to help you understand CVE-2026-48806. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70