CVE-2026-48805: 
PHP vulnerability analysis and mitigation

CVE-2026-48805 is a sandbox state regression vulnerability in the Twig PHP template engine that allows attackers to bypass sandbox callable restrictions via deprecated internal wrapper functions. Affecting all versions of twig/twig prior to 3.27.0, the flaw was discovered by El Kharoubi Iosif, first published on May 27, 2026, and formally assigned a CVE on June 30, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) per NVD scoring, though the GitHub Advisory rates it as Low severity given the narrow exploitation preconditions (Github Advisory, Symfony Blog).

The root cause is a protection mechanism failure (CWE-693) introduced when Twig 3.26.0 refactored CoreExtension::checkArrow(), arraySome(), and arrayEvery() to accept a boolean $isSandboxed parameter instead of an Environment object. The deprecated legacy wrapper functions in src/Resources/core.php — twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() — were not updated to forward the sandbox state: twig_array_some() and twig_array_every() call the underlying methods without the $isSandboxed argument, which defaults to false, silently bypassing the Closure-only restriction and allowing string callables like 'strcmp' or 'is_string' to be accepted in sandbox mode. Additionally, twig_check_arrow_in_sandbox() passes an Environment object where a bool is now expected, causing a TypeError on PHP 8+. Compiled Twig templates are not affected; only applications that directly invoke the deprecated twig_* helper functions on top of a sandboxed Environment are vulnerable (Github Advisory, Twig Commit).

Successful exploitation allows an attacker to execute arbitrary PHP callable functions (e.g., string callables like system, exec, or file_get_contents) within a Twig sandbox environment that should restrict execution to Closure objects only. This can lead to unauthorized access to protected server-side resources, sensitive data disclosure, or arbitrary code execution depending on which PHP functions are reachable. The impact is limited to applications that use the deprecated twig_* wrapper functions in conjunction with a sandboxed Twig environment, reducing the overall attack surface (Github Advisory, Symfony Blog).

1. Identify target: Locate a PHP application using twig/twig versions <= 3.26.0 that operates a sandboxed Twig environment and directly calls the deprecated twig_array_some(), twig_array_every(), or twig_check_arrow_in_sandbox() helper functions (rather than compiled templates).
2. Craft malicious callable: Prepare a string callable (e.g., 'system', 'exec', 'file_get_contents') that would normally be rejected by the Twig sandbox's Closure-only restriction.
3. Invoke deprecated wrapper: Trigger a code path that calls twig_array_some($env, $array, 'system') or twig_array_every($env, $array, 'exec') — because these wrappers do not forward $isSandboxed, the underlying CoreExtension::arraySome()/arrayEvery() defaults $isSandboxed to false and accepts the string callable without restriction.
4. Achieve sandbox bypass: The string callable is executed against each array element, effectively running arbitrary PHP functions within the sandboxed context that should have been blocked (Github Advisory, Twig Commit).

• Logs: PHP error logs or application logs showing calls to deprecated functions with deprecation notices: Using the internal "twig_array_some" function is deprecated or twig_array_every / twig_check_arrow_in_sandbox — especially if accompanied by unexpected callable arguments.
• Logs: TypeError exceptions in PHP 8+ logs referencing CoreExtension::checkArrow() receiving an Environment object instead of a bool, indicating attempted use of twig_check_arrow_in_sandbox().
• Process: Unexpected PHP process behavior such as file reads, network connections, or command execution originating from the web server process when Twig template rendering occurs.
• File System: Unexpected file access or creation in directories accessible to the web server user, potentially indicating exploitation of callable functions like file_put_contents or system via the sandbox bypass.

Upgrade twig/twig to version 3.27.0 or later, which fixes all three deprecated wrappers by resolving the sandbox state via twig_resolve_is_sandboxed() and forwarding it correctly to the corresponding CoreExtension::* methods (Twig v3.27.0 Release, Twig Commit). As a workaround if immediate patching is not possible, audit all application code for direct calls to twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() and replace them with direct calls to the corresponding CoreExtension::* methods with the correct $isSandboxed argument, or migrate to compiled Twig templates which are unaffected. Additionally, review all template code for potential sandbox bypass attempts and implement additional input validation to reduce reliance on sandbox protections alone (Symfony Blog).

The vulnerability was discussed on the r/symfony subreddit shortly after disclosure, reflecting community awareness among PHP/Symfony developers. The fix was included in Twig 3.27.0 alongside several other sandbox-related security fixes, suggesting a broader hardening effort by maintainer Fabien Potencier. Red Hat tracked the issue via Bugzilla (Bug 2500738) and assessed it as medium severity for their products (Red Hat Bugzilla). Linux distribution maintainers also flagged it as part of broader PHP package update advisories (Symfony Blog).