Critical severity9.1OSV Advisory· Published Jul 14, 2026· Updated Jul 17, 2026
CVE-2026-48807
CVE-2026-48807
Description
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
twig/twigPackagist | < 3.27.0 | 3.27.0 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-8x9c-rmqh-456cghsaADVISORY
- github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456cnvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48807.yamlghsaWEB
- github.com/twigphp/Twig/releases/tag/v3.27.0nvdRelease NotesWEB
- symfony.com/blog/cve-2026-48807-sandbox-tostring-policy-bypass-via-traversable-in-join-replace-and-in-not-in-operatorsghsaWEB
News mentions
0No linked articles in our index yet.