CVE-2026-48807

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/twigphp/Twig/releases/tag/v3.27.0	Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Twig es un lenguaje de plantillas para PHP. Antes de la versión 3.27.0, las comprobaciones __toString() del sandbox no cubren completamente los valores Traversable pasados a los filtros join y replace o a los operandos evaluados por los operadores in y not in, permitiendo que los objetos Stringable contenidos sean forzados a cadenas sin consultar la política del sandbox. Este problema está solucionado en la versión 3.27.0.

Information

Published : 2026-07-14 22:17

Updated : 2026-10-24 22:10

NVD link : CVE-2026-48807

Mitre link : CVE-2026-48807

CVE.ORG link : CVE-2026-48807

JSON object : View

Products Affected

symfony

twig

CWE

CWE-693

Protection Mechanism Failure

CWE-863

Incorrect Authorization

{"id": "CVE-2026-48807", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48807", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T12:46:57.656178Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "twigphp", "product": "Twig", "versions": [{"status": "affected", "version": "< 3.27.0"}]}]}], "published": "2026-07-14T22:17:05.090", "references": [{"url": "https://github.com/twigphp/Twig/releases/tag/v3.27.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-693"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0."}, {"lang": "es", "value": "Twig es un lenguaje de plantillas para PHP. Antes de la versi\u00f3n 3.27.0, las comprobaciones __toString() del sandbox no cubren completamente los valores Traversable pasados a los filtros join y replace o a los operandos evaluados por los operadores in y not in, permitiendo que los objetos Stringable contenidos sean forzados a cadenas sin consultar la pol\u00edtica del sandbox. Este problema est\u00e1 solucionado en la versi\u00f3n 3.27.0."}], "lastModified": "2026-10-24T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6B5C37C-83AB-43D0-9297-2D2B7815DF4A", "versionEndExcluding": "3.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}