Critical severity · published Jul 14, 2026
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twig · twigphp
< 3.27.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-48807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-48807
Release Notes
https://github.com/twigphp/Twig/releases/tag/v3.27.0
Vendor Advisory
https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c
More from Twig
9.9
CVE-2026-24425
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
9.8
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
9.8
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
9.1
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
9.1
CVE-2026-48805
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`