CVE-2026-48807 Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
Attackers can bypass Twig sandbox restrictions to execute unauthorized code via Stringable objects in join and replace filters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48807?
CVE-2026-48807 is a high-severity vulnerability in twigphp Twig, published on 14 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Which versions are affected by CVE-2026-48807?
2 open source packages ship an affected version, including twig/twig. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twig/twig Packagist | All versions | 3.27.0 |
twig/twig Packagist | All versions | 3.27.0 |
Products include Symfony Twig.
How do I fix CVE-2026-48807?
Upgrade twig/twig to 3.27.0 or later.
Is CVE-2026-48807 being exploited?
There is no known exploitation of CVE-2026-48807 in the wild and no public exploit code.
Other vulnerabilities in twigphp Twig
- CVE-2018-13818 Code injection in n/a
- CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name
- CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
- CVE-2024-45411 Twig has a possible sandbox bypass
Sources
Also known as DEBIAN-CVE-2026-48807, GHSA-8x9c-rmqh-456c, UBUNTU-CVE-2026-48807.