CVE-2026-48808: 
PHP vulnerability analysis and mitigation

CVE-2026-48808 is a sandbox property allowlist bypass vulnerability in Twig, the PHP template engine, affecting all versions up to and including 3.26.0. It is a residual bypass of CVE-2026-46635, specifically targeting sandboxing enabled via SourcePolicyInterface rather than the global sandbox mode. The vulnerability was reported by Vincent55 Yang, first disclosed by Symfony on May 27, 2026, and published to the GitHub Advisory Database on June 30, 2026. It carries a CVSS v4.0 base score of 6.0 (Medium) (Symfony Advisory, Github Advisory).

The root cause is a protection mechanism failure (CWE-693) combined with incorrect authorization (CWE-863) in CoreExtension::column(). The function receives the active sandbox state as a boolean $isSandboxed via the needs_is_sandboxed channel, but when routing per-element property reads through SandboxExtension::checkPropertyAllowed(), it fails to forward the current Source object. Internally, SandboxExtension::checkPropertyAllowed() re-evaluates isSandboxed($source) with $source = null, causing the SourcePolicyInterface-driven decision to be lost — the method short-circuits to "not sandboxed" and the property allowlist is never consulted. An attacker who is a template author with column on their allowedFilters list can exploit this to read any public or magic property of any object in the render context, bypassing SecurityPolicy::$allowedProperties. The fix modifies CoreExtension::column() to call the security policy directly rather than routing through the SandboxExtension wrapper, ensuring the per-source sandbox decision is honored consistently (Github Advisory, Fix Commit).

Successful exploitation allows a template author to read any public or magic (__get) property of any object reachable in the render context, regardless of the configured SecurityPolicy::$allowedProperties allowlist. This is a confidentiality-only impact — integrity and availability are not affected — but sensitive application data such as credentials, tokens, or internal configuration values exposed as object properties could be exfiltrated. The bypass is narrowly scoped: it only affects deployments using SourcePolicyInterface-based sandboxing with column in the allowed filters list; direct attribute access and global sandbox mode remain protected (Github Advisory, Symfony Advisory).

1. Identify target environment: Confirm the application uses Twig <= 3.26.0 with sandboxing enforced via SourcePolicyInterface (not global sandbox mode) and that the column filter is included in the allowedFilters list.
2. Craft a malicious template: As a template author with access to submit or modify Twig templates, write a template that uses the column filter to extract a restricted property from an object in the render context, e.g., {{ [obj]|column('sensitiveProperty')|first }}.
3. Trigger template rendering: Cause the application to render the crafted template. Because CoreExtension::column() does not forward the Source to SandboxExtension::checkPropertyAllowed(), the SourcePolicyInterface decision is lost and the property allowlist check is skipped.
4. Exfiltrate data: The output of the template will contain the value of the restricted property (e.g., a password, token, or internal configuration value) that would otherwise be blocked by SecurityPolicy::$allowedProperties (Github Advisory, Fix Commit).

• Logs: Application logs showing unexpected template rendering output containing sensitive object property values; error logs showing SecurityNotAllowedPropertyError exceptions being suppressed or absent where they would be expected under a strict sandbox policy.
• File System: Presence of Twig templates containing |column( filter calls accessing properties not explicitly listed in SecurityPolicy::$allowedProperties.
• Application Behavior: Unexpected data exposure in rendered template output, particularly values from object properties that should be restricted by the sandbox policy.

Upgrade twig/twig to version 3.27.0 or later, which contains the fix that modifies CoreExtension::column() to call the security policy directly rather than routing through SandboxExtension::checkPropertyAllowed(). No configuration-based workaround is available; the only effective remediation is upgrading to the patched version. As an interim measure, operators can remove column from the allowedFilters list in their sandbox configuration to eliminate the attack vector until an upgrade is possible (Symfony Advisory, Twig v3.27.0 Release).

The vulnerability was discussed on the Symfony subreddit shortly after disclosure, with community members noting its narrow scope (affecting only SourcePolicyInterface-based sandboxing). The Symfony blog published the official advisory authored by Fabien Potencier, who also provided the fix. The issue was credited to researcher Vincent55 Yang for responsible disclosure (Symfony Advisory, Github Advisory).