CVE-2026-48808: 
PHP vulnerability analysis and mitigation

CVE-2026-48808 is a sandbox property allowlist bypass vulnerability in the Twig PHP template engine affecting all versions prior to 3.27.0. It is a residual bypass of CVE-2026-46635, specifically impacting sandboxing enabled through SourcePolicyInterface (not the regular global sandbox mode). The vulnerability was discovered by Vincent55 Yang, first disclosed by Symfony on May 27, 2026, and published to the GitHub Advisory Database on June 30, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.0 (Medium) (Symfony Advisory, GitHub Advisory).

The root cause lies in CoreExtension::column(), which receives the active sandbox state as a boolean $isSandboxed but routes per-element property reads through SandboxExtension::checkPropertyAllowed() without forwarding the current Source object (CWE-693: Protection Mechanism Failure; CWE-863: Incorrect Authorization). When SandboxExtension::checkPropertyAllowed() re-evaluates isSandboxed($source) internally with $source = null, the SourcePolicyInterface-driven decision is lost, causing the method to short-circuit to "not sandboxed" and skip the property allowlist entirely. This allows a template author who has column on their allowedFilters list to read any public or magic property of any object in the render context, bypassing SecurityPolicy::$allowedProperties. The fix in commit 09c6706 changes CoreExtension::column() to call the security policy directly rather than routing through the SandboxExtension wrapper, ensuring the per-source sandbox decision is honored consistently (GitHub Commit, GitHub Advisory).

Successful exploitation allows a template author to read any public or magic property of any object reachable in the render context, regardless of the configured SecurityPolicy::$allowedProperties allowlist. This results in unauthorized information disclosure — potentially exposing sensitive application data, credentials, or internal object state — with no impact on integrity or availability. The vulnerability is scoped to applications using SourcePolicyInterface-based sandboxing with column in the allowed filters list; direct attribute access and global sandbox mode are unaffected (GitHub Advisory, Red Hat Bugzilla).

1. Identify a vulnerable target: Locate a PHP application using twig/twig version ≤ 3.26.0 that has sandboxing configured via SourcePolicyInterface (not global sandbox mode) and has column included in the allowedFilters list.
2. Gain template authoring access: Obtain the ability to author or inject Twig templates in the target application — this may be through a CMS, user-generated content feature, or any interface that renders attacker-controlled Twig templates.
3. Craft a malicious template: Write a Twig template that uses the column filter to access a restricted property on an object available in the render context, e.g., {{ [sensitiveObject]|column('restrictedProperty')|first }}.
4. Trigger template rendering: Submit or activate the crafted template so the application renders it. Because CoreExtension::column() does not forward the Source to SandboxExtension::checkPropertyAllowed(), the property allowlist check is skipped.
5. Exfiltrate data: The rendered output will contain the value of the restricted property, which can be read directly from the response or exfiltrated via further template logic (GitHub Advisory, GitHub Commit).

• Logs: Application logs showing unexpected rendering of templates containing the column filter applied to objects with properties not in the configured allowedProperties list; SecurityNotAllowedPropertyError exceptions absent where they should be present (indicating the bypass is in effect on unpatched systems).
• Template Content: Presence of Twig templates using |column('propertyName') patterns targeting sensitive object properties that are not explicitly allowlisted in SecurityPolicy::$allowedProperties.
• Application Behavior: Unexpected data appearing in rendered template output that corresponds to restricted object properties, particularly in contexts where SourcePolicyInterface sandboxing is configured.

Upgrade twig/twig to version 3.27.0 or later, which contains the fix in commit 09c6706 that changes CoreExtension::column() to call the security policy directly rather than routing through SandboxExtension::checkPropertyAllowed(). No configuration-based workaround is available; the only effective remediation is upgrading to the patched version. As an interim measure, removing column from the allowedFilters list in the sandbox configuration will prevent exploitation at the cost of losing that filter's functionality (Symfony Advisory, Twig v3.27.0 Release).

The Symfony project published an official advisory on May 27, 2026, crediting Vincent55 Yang for the discovery and Fabien Potencier for the fix. A Reddit discussion in the r/symfony community noted the vulnerability shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (Symfony Advisory).