CVE-2026-48805
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability in Twig before version 3.27.0 allows bypassing sandbox restrictions through deprecated internal wrappers in src/Resources/core.php. Functions like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() do not forward the current sandbox state to CoreExtension methods, enabling unauthorized callable execution.
Risk Assessment
The risk involves bypassing sandbox security mechanisms, potentially leading to execution of dangerous operations in templates, which could enable remote code execution or privilege escalation in applications using Twig.
Recommendation
Immediately upgrade Twig to version 3.27.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.