CVE-2026-48807 | Twig is a template language for PHP. Prior to 3.27.0, the sa… | CVSS 7.1 HIGH

Description

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

Metadata

CVE ID: CVE-2026-48807
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-22 20:57 UTC
Published: 2026-07-14 21:29 UTC
Last updated: 2026-07-15 12:50 UTC
Primary CWE: CWE-693
CWE-693: Protection Mechanism Failure
Vendor / Product: twigphp / Twig
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
twigphp	Twig	—	< 3.27.0

Weakness (CWE)

CWE	Source	Description
CWE-693	cna	CWE-693: Protection Mechanism Failure
CWE-863	cna	CWE-863: Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References (2)

https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c
https://github.com/twigphp/Twig/releases/tag/v3.27.0 https://github.com/twigphp/Twig/releases/tag/v3.27.0