CVE-2026-48806

Name of the Vulnerable Software and Affected Versions Twig versions prior to 3.26.0

Description An issue exists where the sandbox visitor fails to wrap mapping keys in ArrayExpression with CheckToStringNode. When a dynamic key expression resolves to a Stringable object, the ArrayExpression::compile() function emits a raw cast or no cast at all, causing PHP to invoke the toString() method directly. This bypasses the SandboxExtension::ensureToStringAllowed() check, allowing a sandboxed template author to trigger toString() on any object reachable in the render context by using it as a dynamic mapping key. This can lead to the unauthorized disclosure of data returned by the toString() method.

Recommendations Update to version 3.26.0 or later.