PT-2026-47220 · Twig · Twig

CVE-2026-48807

·

Published

2026-05-27

·

Updated

2026-07-15

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)
Description An issue exists where a sandboxed template author can trigger a disallowed toString() method on objects reachable from the render context, bypassing the security policy. This occurs through two primary mechanisms:
  1. In CoreExtension::join() and CoreExtension::replace(), Traversable values are not properly policy-checked during recursion. These filters later materialize the inputs, leading to implicit string coercion of contained Stringable objects.
  2. The in and not in operators, which compile to CoreExtension::inFilter(), use PHP's <=> operator. This causes the object to be coerced to a string via toString() without consulting the sandbox policy. This can be used as a content-leak oracle to reconstruct strings returned by toString() through chained probes.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Protection Mechanism Failure

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-693CWE-863

Related Identifiers

CVE-2026-48807
GHSA-8X9C-RMQH-456C

Affected Products

Twig