CVE-2026-48808
PHP vulnerability analysis and mitigation

Overview

CVE-2026-48808 is a sandbox property allowlist bypass vulnerability in Twig, the PHP template engine, affecting all versions up to and including 3.26.0. It is a residual bypass of CVE-2026-46635, specifically targeting sandboxing enabled via SourcePolicyInterface rather than the global sandbox mode. The vulnerability was reported by Vincent55 Yang, first disclosed by Symfony on May 27, 2026, and published to the GitHub Advisory Database on June 30, 2026. It carries a CVSS v4.0 base score of 6.0 (Medium) (Symfony Advisory, Github Advisory).

Technical details

The root cause is a protection mechanism failure (CWE-693) combined with incorrect authorization (CWE-863) in CoreExtension::column(). The function receives the active sandbox state as a boolean $isSandboxed via the needs_is_sandboxed channel, but when routing per-element property reads through SandboxExtension::checkPropertyAllowed(), it fails to forward the current Source object. Internally, SandboxExtension::checkPropertyAllowed() re-evaluates isSandboxed($source) with $source = null, causing the SourcePolicyInterface-driven decision to be lost — the method short-circuits to "not sandboxed" and the property allowlist is never consulted. An attacker who is a template author with column on their allowedFilters list can exploit this to read any public or magic property of any object in the render context, bypassing SecurityPolicy::$allowedProperties. The fix modifies CoreExtension::column() to call the security policy directly rather than routing through the SandboxExtension wrapper, ensuring the per-source sandbox decision is honored consistently (Github Advisory, Fix Commit).

Impact

Successful exploitation allows a template author to read any public or magic (__get) property of any object reachable in the render context, regardless of the configured SecurityPolicy::$allowedProperties allowlist. This is a confidentiality-only impact — integrity and availability are not affected — but sensitive application data such as credentials, tokens, or internal configuration values exposed as object properties could be exfiltrated. The bypass is narrowly scoped: it only affects deployments using SourcePolicyInterface-based sandboxing with column in the allowed filters list; direct attribute access and global sandbox mode remain protected (Github Advisory, Symfony Advisory).

Exploitation steps

  1. Identify target environment: Confirm the application uses Twig <= 3.26.0 with sandboxing enforced via SourcePolicyInterface (not global sandbox mode) and that the column filter is included in the allowedFilters list.
  2. Craft a malicious template: As a template author with access to submit or modify Twig templates, write a template that uses the column filter to extract a restricted property from an object in the render context, e.g., {{ [obj]|column('sensitiveProperty')|first }}.
  3. Trigger template rendering: Cause the application to render the crafted template. Because CoreExtension::column() does not forward the Source to SandboxExtension::checkPropertyAllowed(), the SourcePolicyInterface decision is lost and the property allowlist check is skipped.
  4. Exfiltrate data: The output of the template will contain the value of the restricted property (e.g., a password, token, or internal configuration value) that would otherwise be blocked by SecurityPolicy::$allowedProperties (Github Advisory, Fix Commit).

Indicators of compromise

  • Logs: Application logs showing unexpected template rendering output containing sensitive object property values; error logs showing SecurityNotAllowedPropertyError exceptions being suppressed or absent where they would be expected under a strict sandbox policy.
  • File System: Presence of Twig templates containing |column( filter calls accessing properties not explicitly listed in SecurityPolicy::$allowedProperties.
  • Application Behavior: Unexpected data exposure in rendered template output, particularly values from object properties that should be restricted by the sandbox policy.

Mitigation and workarounds

Upgrade twig/twig to version 3.27.0 or later, which contains the fix that modifies CoreExtension::column() to call the security policy directly rather than routing through SandboxExtension::checkPropertyAllowed(). No configuration-based workaround is available; the only effective remediation is upgrading to the patched version. As an interim measure, operators can remove column from the allowedFilters list in their sandbox configuration to eliminate the attack vector until an upgrade is possible (Symfony Advisory, Twig v3.27.0 Release).

Community reactions

The vulnerability was discussed on the Symfony subreddit shortly after disclosure, with community members noting its narrow scope (affecting only SourcePolicyInterface-based sandboxing). The Symfony blog published the official advisory authored by Fabien Potencier, who also provided the fix. The issue was credited to researcher Vincent55 Yang for responsible disclosure (Symfony Advisory, Github Advisory).

Additional resources


SourceThis report was generated using AI

Related PHP vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

GHSA-h95v-h523-3mw8MEDIUM5.9
  • PHP logoPHP
  • guzzlehttp/guzzle
NoYesJul 20, 2026
GHSA-wm3w-8rrp-j577MEDIUM5.9
  • PHP logoPHP
  • guzzlehttp/guzzle
NoYesJul 20, 2026
GHSA-f283-ghqc-fg79MEDIUM5.3
  • PHP logoPHP
  • guzzlehttp/guzzle
NoYesJul 20, 2026
GHSA-94pj-82f3-465wMEDIUM5.3
  • PHP logoPHP
  • guzzlehttp/guzzle
NoYesJul 20, 2026
CVE-2026-55219MEDIUM5.3
  • PHP logoPHP
  • paymenter/paymenter
NoYesJul 20, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management