CVE-2026-48807
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in the Twig template library for PHP allows sandbox bypass for Stringable objects when used with Traversable values in join and replace filters or in and not in operators. Prior to version 3.27.0, the sandbox __toString() checks did not fully cover these cases, enabling coercion to strings without sandbox policy enforcement.
Risk Assessment
An attacker could exploit this flaw to force string conversion of objects without sandbox restrictions, potentially leading to sensitive data disclosure or unauthorized operations in production environments.
Recommendation
Upgrade Twig to version 3.27.0 or later immediately to mitigate this vulnerability.
Original NVD description (English source)
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.