CVE-2026-48808

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description An issue exists where sandboxing enabled through SourcePolicyInterface can be bypassed. The CoreExtension::column() function receives the sandbox state via the needs is sandboxed channel as a boolean $isSandboxed, but it routes property reads through SandboxExtension::checkPropertyAllowed() without forwarding the current Source. Consequently, SandboxExtension::checkPropertyAllowed() re-evaluates the sandbox status internally; when $source is null, the decision driven by SourcePolicyInterface is lost, and the system incorrectly assumes the environment is not sandboxed, bypassing the property allowlist. This allows a template author with column in their allowedFilters list to read any public or magic property of any object in the render context, regardless of SecurityPolicy::$allowedProperties.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.