CVE-2026-48808 twigphp CVE debrief

Who should care

Users of Twig template language for PHP, especially those using versions prior to 3.27.0, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating sandbox policies to restrict access to sensitive properties, monitoring template usage, and restricting access to sensitive data.

Technical summary

The column filter in Twig template language for PHP, prior to version 3.27.0, passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(). This allows template authors to read public or magic properties not allowed by the sandbox policy. The issue is fixed in version 3.27.0. Users of Twig should be aware of this vulnerability and take steps to mitigate it.

Defensive priority

Medium priority for users of Twig template language for PHP, especially in environments where template authors may be able to exploit this vulnerability.

Recommended defensive actions

• Upgrade to Twig version 3.27.0 or later
• Review and update sandbox policies to restrict access to sensitive properties
• Monitor template usage and restrict access to sensitive data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, its impact, and the fixed version. The vendor advisory and patch notes provide additional context on the issue and its resolution. The vulnerability allows template authors to read public or magic properties not allowed by the sandbox policy, which can lead to security issues if not properly mitigated.

Official resources