CVE-2026-48807

Analyzed Analyzed - Analysis Complete

Twig Template Engine Sandbox Escape via Stringable Object

Publication date: 2026-07-14

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-17

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48807

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Twig, a PHP template language, exists in versions prior to 3.27.0. It involves incomplete sandbox checks for Traversable values in join and replace filters or in/not in operators. This allows Stringable objects within these values to be converted to strings without proper sandbox policy enforcement.

Detection Guidance

To detect this vulnerability, check the installed version of Twig. If you are using a version prior to 3.27.0, the system is vulnerable. Run: composer show twig/twig or grep the version in your project's dependencies.

Impact Analysis

An attacker could exploit this to bypass intended sandbox restrictions, potentially leading to unauthorized code execution or data exposure in applications using affected Twig versions. This may allow compromise of the PHP application's security context.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Twig versions may face compliance violations if exploited.

Mitigation Strategies

Update Twig to version 3.27.0 or later to address the sandbox bypass issue in join, replace, in, and not in operators.

Hi! I’m here to help you understand CVE-2026-48807. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70