The vulnerability (CVE-2026-48808) is a residual bypass of a previous issue (CVE-2026-46635) affecting twig/twig's sandboxing when enabled via `SourcePolicyInterface`. The `CoreExtension::column()` method receives a sandbox state boolean but delegates property access checks to `SandboxExtension::checkPropertyAllowed()` without forwarding the source context. This causes `checkPropertyAllowed()` to treat the source as null, bypassing the property allowlist enforced by `SecurityPolicy::$allowedProperties`. Consequently, template authors with `column` in their allowed filters can access any public or magic property of objects in the rendering context, violating sandbox restrictions. The issue does not affect the global sandbox mode and is fixed by having `CoreExtension::column()` call the security policy directly with the sandbox state, ensuring consistent enforcement.

The vulnerability allows unauthorized read access to any public or magic property of objects accessible in the template rendering context when sandboxing is enabled via `SourcePolicyInterface`. This bypasses the intended property allowlist restrictions, potentially exposing sensitive data or internal state that should be protected by the sandbox. Direct attribute access and global sandbox mode remain protected, limiting the scope to specific sandbox configurations using `SourcePolicyInterface` and the `column` filter.

Upgrade twig/twig to version 3.27.0 or later, where the vulnerability is fixed by changing `CoreExtension::column()` to call the security policy directly, preserving the sandbox source context and enforcing the property allowlist correctly. No other mitigation is required as this is a policy enforcement gap fixed in the official release. Patch status is confirmed by the versioning information provided.