CVE-2026-48806
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability in the Twig template library for PHP before version 3.27.0 allows bypassing the SandboxExtension::ensureToStringAllowed() check when coercing dynamic mapping keys to strings. An attacker can exploit a Stringable object used as an array key to invoke its __toString() method without proper sandbox validation.
Risk Assessment
The risk involves potential unauthorized execution of operations via Stringable objects used as mapping keys, which could lead to data leakage or privilege escalation in environments relying on Twig sandboxing.
Recommendation
Immediately upgrade Twig to version 3.27.0 or later, which includes a fix that properly validates string coercion of mapping keys.
Original NVD description (English source)
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.