CVE-2026-48806: Twig · Sandbox `__toString()` policy bypass via dynamic mapping keys
Affects twig/twigSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited : upgrade to 3.27.0 when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 3.27.0
Exploitation evidence
Disclosed: evidence found.
CVE published 30 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade twig/twig to 3.27.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagisttwig/twig | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
### Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded `__toString()` calls. In 3.26.0 the sandbox visitor was extended to wrap every child node that its parent will string-coerce at runtime with `CheckToStringNode`, gated by the new `CoercesChildrenToStringInterface`. `ArrayExpression` did not implement the interface for its mapping keys: when a dynamic key expression resolves to a `Stringable` object, `ArrayExpression::compile()` emits a raw `(string)` cast (via `StringCastUnary` for `ContextVariable` keys, and no cast at all for richer key expressions). PHP then invokes `__toString()` directly, without ever calling `SandboxExtension::ensureToStringAllowed()`. A sandboxed template author can therefore trigger `__toString()` on any object reachable in the render context by using it as a dynamic mapping key, for example: ```twig {% set arr = {(obj): "value"} %} ``` Direct output of the same object is correctly blocked, which makes this a clear policy enforcement gap. The reliable demonstrated impact is unauthorised disclosure of data returned by `__toString()`. ### Resolution `ArrayExpression` now declares its dynamic mapping keys as string-coercion sites through `CoercesChildrenToStringInterface`, so the sandbox visitor wraps them with `CheckToStringNode` and the policy is consulted before PHP coerces the key to a string. The compiler also keeps an explicit `(string)` cast around the wrapped expression so PHP type errors on non-string keys are preserved. As a side effect, any expression is now accepted as a dynamic mapping key (not only context variables); this is documented as a new feature on the 3.x branch. ### Credits Twig would like to thank El Kharoubi Iosif for reporting the issue and Fabien Potencier for providing the fix.
References
- github.com/twigphp/Twig/security/advisories/GHSA-5v5v-ww74-355v (opens in a new tab)
- github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48806.yaml (opens in a new tab)
- github.com/twigphp/Twig (opens in a new tab)
- github.com/twigphp/Twig/releases/tag/v3.27.0 (opens in a new tab)
- symfony.com/blog/cve-2026-48806-sandbox-tostring-policy-bypass-via-dynamic-mapping-keys (opens in a new tab)