CVE-2026-48805: 
PHP vulnerability analysis and mitigation

CVE-2026-48805 is a sandbox state regression vulnerability in the Twig PHP template engine, classified as a Protection Mechanism Failure (CWE-693). It affects all versions of twig/twig up to and including 3.26.0, and was introduced by a signature change in the 3.26.0 source-policy hardening that was not propagated to deprecated internal wrapper functions in src/Resources/core.php. The vulnerability was reported by El Kharoubi Iosif, disclosed by Fabien Potencier on May 27, 2026, and formally published to the GitHub Advisory Database on June 30, 2026. It carries a CVSS v4.0 base score of 5.3 (Medium) (Symfony Advisory, GitHub Advisory).

The root cause is a failure to forward the current sandbox state in three deprecated legacy wrapper functions — twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() — located in src/Resources/core.php (CWE-693). When Twig 3.26.0 refactored CoreExtension::checkArrow(), arraySome(), and arrayEvery() to accept a boolean $isSandboxed parameter instead of an Environment object, the compiled templates were updated correctly, but the deprecated wrappers were not. As a result, twig_array_some() and twig_array_every() call the underlying methods without passing the sandbox state, causing $isSandboxed to default to false and silently bypassing the callable-must-be-a-Closure restriction — allowing string callables like 'strcmp' or 'is_string' to be accepted in sandbox mode. Additionally, twig_check_arrow_in_sandbox() passes an Environment object where a bool is now expected, triggering a TypeError on PHP 8+. Only applications that directly invoke the deprecated twig_* helper functions on top of a sandboxed Environment are affected; compiled Twig templates call CoreExtension::* directly with correct arguments and are not impacted (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to bypass Twig's sandbox callable restrictions, enabling the execution of arbitrary PHP string callables (e.g., built-in PHP functions) that would otherwise be blocked in sandbox mode. The primary impact is an integrity violation — untrusted template code can invoke restricted PHP functions — with no direct confidentiality or availability impact as scored (CVSS v4.0: VI:L, VC:N, VA:N). The scope is limited to applications that use the deprecated twig_* wrapper functions within a sandboxed Twig environment, which narrows the affected population to legacy codebases that have not migrated away from these deprecated helpers (GitHub Advisory, Feedly).

1. Identify target: Locate a PHP application using twig/twig <= 3.26.0 that operates a sandboxed Twig environment and still calls the deprecated twig_array_some(), twig_array_every(), or twig_check_arrow_in_sandbox() wrapper functions directly.
2. Craft malicious callable: Prepare a string callable (e.g., a built-in PHP function name such as 'system', 'exec', or 'is_string') that would normally be rejected by the Twig sandbox's Closure-only restriction.
3. Trigger the vulnerable wrapper: Supply the string callable as the $arrow argument to the vulnerable wrapper function (e.g., twig_array_some($env, $array, 'system')). Because the wrapper does not forward the sandbox state, $isSandboxed defaults to false in the underlying CoreExtension::arraySome(), and the string callable passes validation.
4. Achieve sandbox bypass: The string callable is executed against the array elements without sandbox enforcement, allowing invocation of PHP functions that the sandbox policy was intended to block (GitHub Advisory, Fix Commit).

The fix is available in Twig version 3.27.0, released May 27, 2026. The patch updates the three deprecated wrappers (twig_array_some(), twig_array_every(), twig_check_arrow_in_sandbox()) to resolve the current sandbox state via twig_resolve_is_sandboxed() and forward it correctly to the corresponding CoreExtension::* methods. Operators should upgrade to twig/twig >= 3.27.0 via Composer (composer update twig/twig). As a secondary measure, applications should migrate away from the deprecated twig_* helper functions entirely, as they have been deprecated since Twig 3.9 and will be removed in a future major version (Symfony Advisory, Twig v3.27.0 Release).

The vulnerability was discussed on the r/symfony subreddit shortly after disclosure, reflecting community awareness among PHP/Symfony developers. The fix was included in the Twig 3.27.0 release alongside several other sandbox-related security fixes, suggesting a broader hardening effort by maintainer Fabien Potencier. No significant media coverage or notable researcher commentary beyond the official advisory has been identified (Reddit r/symfony, Twig v3.27.0 Release).