CVE-2026-48805: Twig · Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
Affects twig/twigSource GCVE Database
Not known to be exploited : upgrade to 3.27.0 when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.27.0
Exploitation evidence
Disclosed: evidence found.
CVE published 30 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade twig/twig to 3.27.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagisttwig/twig | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
### Description The 3.26.0 source-policy hardening changed the signature of `CoreExtension::checkArrow()` to take a boolean `$isSandboxed` instead of an `Environment`, and added the same `$isSandboxed` argument to `CoreExtension::arraySome()` and `CoreExtension::arrayEvery()`. Compiled templates were updated to pass the per-source sandbox state computed at the call site. The deprecated internal wrappers exposed in `src/Resources/core.php` for legacy third-party code (`twig_check_arrow_in_sandbox()`, `twig_array_some()`, `twig_array_every()`) were not updated: - `twig_array_some()` and `twig_array_every()` call `CoreExtension::arraySome()` / `arrayEvery()` without forwarding the sandbox state. The underlying methods default `$isSandboxed` to `false`, so the callable-must-be-a-`Closure` restriction is silently bypassed in sandbox mode and a string callable such as `'strcmp'` is accepted. - `twig_check_arrow_in_sandbox()` passes the `Environment` object where `CoreExtension::checkArrow()` now expects a `bool`, which throws a `TypeError` on PHP 8+. Compiled Twig templates are not affected: they call `CoreExtension::*` directly with the correct arguments. Applications are only impacted if they still call the deprecated `twig_*` helpers on top of a sandboxed `Environment`. ### Resolution The three wrappers now resolve the current sandbox state via `twig_resolve_is_sandboxed()` (the same helper compiled templates use), and forward it to the corresponding `CoreExtension::*` method. `twig_check_arrow_in_sandbox()` no longer triggers a `TypeError`, and `twig_array_some()` / `twig_array_every()` now enforce the same sandbox restriction as compiled templates. ### Credits We would like to thank El Kharoubi Iosif for reporting the issue and Fabien Potencier for providing the fix.
References
- github.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wq (opens in a new tab)
- github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48805.yaml (opens in a new tab)
- github.com/twigphp/Twig (opens in a new tab)
- github.com/twigphp/Twig/releases/tag/v3.27.0 (opens in a new tab)
- symfony.com/blog/cve-2026-48805-sandbox-state-regression-in-deprecated-internal-wrappers-in-src-resources-core-php (opens in a new tab)