PT-2026-47218 · Twig · Twig

CVE-2026-48805 · Published 2026-05-27 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.26.0

Description Deprecated internal wrappers in src/Resources/core.php for legacy third-party code fail to correctly handle sandbox state. Specifically, the functions twig array some() and twig array every() call CoreExtension::arraySome() and CoreExtension::arrayEvery() without forwarding the sandbox state. Because the underlying methods default the isSandboxed variable to false, the restriction requiring callables to be closures is bypassed in sandbox mode, allowing string callables like 'strcmp' to be accepted. Additionally, twig check arrow in sandbox() passes an Environment object to CoreExtension::checkArrow() instead of the expected boolean, resulting in a TypeError on PHP 8+.

Recommendations Update to version 3.26.0 or later. As a temporary workaround, avoid using the deprecated twig array some(), twig array every(), and twig check arrow in sandbox() helper functions when using a sandboxed environment.

Exploit

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2026-48805

GHSA-P42Q-9PRX-Q5WQ

Affected Products

Twig

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48805.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48805.yaml · Exploit
• https://github.com/twigphp/Twig/commit/e235cae3a1d1e23edc24df4d675f18108c6b167b · Patch
• https://github.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wq · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-48805 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p42q-9prx-q5wq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48805 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-48805 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-48805 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-48805 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-48805 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-48805 · Vendor Advisory
• https://github.com/twigphp/Twig/releases/tag/v3.27.0 · Note
• https://github.com/twigphp/Twig · Note
• https://symfony.com/blog/cve-2026-48805-sandbox-state-regression-in-deprecated-internal-wrappers-in-src-resources-core-php · Note