by Kastro
Paper/Archive/CVE-2026-48805

CVE-2026-48805

twigphp Twig — Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

Affected

ProductAffectedFixed inSource
Twig< 3.27.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub_M (CNA)5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wqrefgithub.com/twigphp/Twig/commit/e235cae3a1d1e23edc24df4d675f18108c6b167brefgithub.com/twigphp/Twig/releases/tag/v3.27.0