CVE-2026-48805: Symfony Twig Auth Bypass Vulnerability

CVE-2026-48805 Overview

CVE-2026-48805 is a sandbox bypass vulnerability in Twig, a widely used template language for PHP maintained by Symfony. Prior to version 3.27.0, deprecated internal wrapper functions in src/Resources/core.php fail to forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(). As a result, legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() bypass sandbox callable restrictions. The issue is fixed in Twig 3.27.0 and is classified under [CWE-693] (Protection Mechanism Failure).

Critical Impact
Authenticated attackers rendering user-controlled templates can invoke callables that the Twig sandbox is designed to block, weakening isolation in multi-tenant PHP applications.

Affected Products

Symfony Twig versions prior to 3.27.0
PHP applications using deprecated twig_array_some() and twig_array_every() wrappers
PHP applications using the deprecated twig_check_arrow_in_sandbox() wrapper

Discovery Timeline

2026-07-14 - CVE-2026-48805 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-48805

Vulnerability Analysis

Twig ships a sandbox mode used to restrict which tags, filters, functions, methods, and callables templates can invoke. The sandbox is commonly enabled when rendering templates authored by untrusted users. The vulnerability stems from deprecated procedural wrappers that were retained for backward compatibility with pre-3.9 code paths.

When a template execution routes through the legacy twig_array_some(), twig_array_every(), or twig_check_arrow_in_sandbox() functions, these wrappers call the modern CoreExtension methods without propagating the active sandbox state. The callable-restriction checks in CoreExtension::checkArrow() therefore evaluate against an unsandboxed context, allowing arrow callables that should be blocked to execute.

Root Cause

The deprecated wrappers in src/Resources/core.php invoke CoreExtension::arraySome(), CoreExtension::arrayEvery(), and the arrow-check routine without passing a resolved $isSandboxed flag. Downstream logic then treats the invocation as if the sandbox were inactive, skipping enforcement of the allowed-callables policy.

Attack Vector

An attacker who can influence template source or supply arrow callables to sandboxed filters can craft input that routes through the deprecated wrappers. This yields callable execution that the sandbox policy would otherwise reject. Exploitation requires the application to still call the legacy functions and to accept some form of attacker-influenced template content or callable expression.

php

// Patch excerpt from src/Resources/core.php
{
    trigger_deprecation('twig/twig', '3.9', 'Using the internal "%s" function is deprecated.', __FUNCTION__);

-    return CoreExtension::arraySome($env, $array, $arrow);
+    return CoreExtension::arraySome($env, $array, $arrow, twig_resolve_is_sandboxed($env));
}

Source: twigphp/Twig commit e235cae

Detection Methods for CVE-2026-48805

Indicators of Compromise

Template rendering logs showing invocation of twig_array_some(), twig_array_every(), or twig_check_arrow_in_sandbox() when the sandbox extension is enabled.
PHP deprecation notices referencing twig/twig version 3.9 internal function usage in production logs.
Unexpected execution of PHP callables, closures, or methods within sandbox-restricted template contexts.

Detection Strategies

Perform static analysis of application code and third-party libraries to locate direct calls to the deprecated twig_array_* wrappers.
Enable Twig deprecation logging and monitor for messages emitted by trigger_deprecation('twig/twig', '3.9', ...).
Review Composer dependency manifests for twig/twig versions earlier than 3.27.0.

Monitoring Recommendations

Alert on PHP error and deprecation logs referencing Twig internal function usage in sandboxed rendering paths.
Track outbound calls, filesystem access, and process spawns originating from PHP-FPM workers that render user-supplied templates.
Correlate template rendering activity with anomalous callable execution using centralized log analytics.

How to Mitigate CVE-2026-48805

Immediate Actions Required

Upgrade twig/twig to version 3.27.0 or later using Composer.
Audit the codebase for references to twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() and migrate to CoreExtension equivalents.
Re-validate sandbox security policies to confirm allowed tags, filters, functions, and methods reflect current requirements.

Patch Information

The fix is available in Twig 3.27.0. The patch updates the deprecated wrappers to forward the sandbox state via twig_resolve_is_sandboxed($env) before calling the modern CoreExtension methods. See the GitHub Security Advisory GHSA-p42q-9prx-q5wq and Twig v3.27.0 release notes for details.

Workarounds

Remove or refactor any application code still calling the deprecated twig_array_some(), twig_array_every(), or twig_check_arrow_in_sandbox() wrappers.
Avoid exposing sandboxed template rendering to untrusted user-supplied arrow callables until the upgrade is applied.
Restrict who can author or modify template content in multi-tenant deployments as a defense-in-depth measure.

bash

# Upgrade Twig via Composer
composer require twig/twig:^3.27.0
composer update twig/twig

# Verify installed version
composer show twig/twig | grep versions