high7.5
CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Impact
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | twig/twig | <= 3.26.0 | 3.27.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Symfony | Twig | before 3.27.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-h8vq-8gpg-mhcg
- https://github.com/twigphp/Twig/security/advisories/GHSA-h8vq-8gpg-mhcg
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48808.yaml
- https://github.com/twigphp/Twig/releases/tag/v3.27.0
- https://symfony.com/blog/cve-2026-48808-sandbox-property-allowlist-bypass-via-the-column-filter-under-sourcepolicyinterface
- https://github.com/twigphp/Twig/commit/09c6706407ed7b1cb2d7d1408004f811e47e0424