CVE-2026-48807 Details
Description
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
A vulnerability in Twig, a PHP template language, prior to version 3.27.0, allows for unauthorized coercion of Stringable objects to strings within the sandbox environment. This issue arises because the sandbox's __toString() checks do not adequately cover Traversable values used in join and replace filters, or in conjunction with the in and not in operators. As a result, Stringable objects can be converted to strings without adhering to the established sandbox policy, potentially leading to unintended consequences.
Users can upgrade to Twig version 3.27.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/twigphp/Twig/releases/tag/v3.27.0 | [email protected] | Release Notes |
| https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| symfony twig | < 3.27.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |