CVE-2026-48808— Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Quick assessment
Affected
twigphp Twig
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
twigphp Twig是twigphp的PHP模板引擎。 twigphp Twig 3.27.0之前版本存在安全漏洞，该漏洞源于column filter将活动沙箱状态作为布尔值传递但未将当前Source转发给SandboxExtension::checkPropertyAllowed()，导致SourcePolicyInterface决策丢失，模板作者可以读取沙箱策略不允许的公共或魔法属性。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48808
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
Source: CVE Program / CVE List V5
Vulnerability Description
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Vulnerability Title
twigphp Twig 处理逻辑错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
twigphp Twig是twigphp的PHP模板引擎。 twigphp Twig 3.27.0之前版本存在安全漏洞，该漏洞源于column filter将活动沙箱状态作为布尔值传递但未将当前Source转发给SandboxExtension::checkPropertyAllowed()，导致SourcePolicyInterface决策丢失，模板作者可以读取沙箱策略不允许的公共或魔法属性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-48808
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48808
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48808 (1)
Vendor Advisories for CVE-2026-48808 (1)
Vendor Pages for CVE-2026-48808 (1)
Same Patch Batch · twigphp · 2026-07-14 · 17 CVEs total
| CVE-2026-46634 | 7.7 HIGH | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized templ |
| CVE-2026-47730 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | |
| CVE-2026-47732 | Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points | |
| CVE-2026-48806 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | |
| CVE-2026-48805 | Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php` | |
| CVE-2026-48807 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filte | |
| CVE-2026-49981 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes betwee | |
| CVE-2026-46635 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | |
| CVE-2026-46638 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete f | |
| CVE-2026-46628 | Twig: The `spaceless` filter implicitly marks its output as safe | |
| CVE-2026-46640 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | |
| CVE-2026-46637 | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` | |
| CVE-2026-46639 | Twig: Sandbox property and method bypass via object-destructuring assignment | |
| CVE-2026-46627 | Twig: Sandbox resource exhaustion via unbounded `for` / `range()` | |
| CVE-2026-46633 | Twig: PHP code injection via `{% use %}` template name | |
| CVE-2026-46629 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled argu |
IV. Related Vulnerabilities
Same product: Twig
-
CVE-2026-46636
Twig: Sandbox method allowlist bypass via `Markup` subclass -
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` -
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mappi -
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappe -
CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass whe
Same vendor: twigphp
-
CVE-2026-46636
Twig: Sandbox method allowlist bypass via `Markup` subclass -
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` -
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mappi -
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappe -
CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass whe
Same weakness: CWE-693
-
CVE-2026-110866
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Reba -
CVE-2026-110689
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetP -
CVE-2026-88838
Busybox: busybox: non-root mount option filter bypass allows -
CVE-2026-94603
Podman: The `podman run` command can be instructed to disabl -
CVE-2026-101899
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy
V. Comments for CVE-2026-48808
No comments yet