CVE-2026-48806 Overview
CVE-2026-48806 is a sandbox bypass vulnerability in Twig, the template language for PHP maintained by Symfony. The flaw resides in ArrayExpression, which does not guard dynamic mapping keys that PHP coerces to strings. An attacker who controls a template can supply a Stringable object as a mapping key, causing PHP to invoke __toString() without calling SandboxExtension::ensureToStringAllowed(). This bypasses the sandbox policy designed to restrict which classes may execute string coercion inside untrusted templates. The issue affects Twig versions prior to 3.27.0 and is tracked under [CWE-693: Protection Mechanism Failure].
Critical Impact
A user with template authoring privileges can bypass Twig's sandbox __toString policy and trigger arbitrary __toString() methods on objects reachable in the template context.
Affected Products
- Symfony Twig versions prior to 3.27.0
- PHP applications using SandboxExtension with untrusted template input
- Downstream frameworks and CMS platforms bundling vulnerable Twig releases
Discovery Timeline
- 2026-07-14 - CVE-2026-48806 published to the National Vulnerability Database
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-48806
Vulnerability Analysis
Twig ships a sandbox mode intended to render templates from untrusted authors safely. SandboxExtension::ensureToStringAllowed() is the gate that decides whether an object's __toString() method may run based on the configured security policy. The sandbox instruments expressions that coerce values to strings so the policy is consulted before PHP performs implicit conversion.
The ArrayExpression node, which compiles Twig mapping literals such as { (key): value }, did not mark itself as a producer of string-coerced children. As a result, dynamic keys were emitted into the compiled PHP without a string-coercion wrapper. When PHP evaluated the resulting array literal, it coerced any Stringable key to a string directly, invoking __toString() outside the sandbox policy check.
Root Cause
The root cause is a missing interface declaration on ArrayExpression. The fix adds CoercesChildrenToStringInterface to the class so Twig's compiler wraps dynamic children in the sandbox-aware string cast path. Without that interface, the compiler treated mapping keys as opaque expressions rather than string-coerced positions.
Attack Vector
Exploitation requires the ability to supply or influence a sandboxed Twig template. The attacker crafts a mapping literal whose key expression resolves to a Stringable object present in the template context. Rendering the template triggers PHP's native key coercion, which calls __toString() on the object without policy enforcement. The impact depends on what __toString() methods are reachable, ranging from information disclosure to further sandbox escape chains when combined with sensitive Stringable implementations.
// Patch excerpt from src/Node/Expression/ArrayExpression.php
use Twig\Compiler;
use Twig\Error\SyntaxError;
use Twig\Node\CoercesChildrenToStringInterface;
use Twig\Node\Expression\Unary\SpreadUnary;
use Twig\Node\Expression\Unary\StringCastUnary;
class ArrayExpression extends AbstractExpression implements SupportDefinedTestInterface, ReturnArrayInterface, CoercesChildrenToStringInterface
{
use SupportDefinedTestTrait;
Source: twigphp/Twig commit 9ff4101
Detection Methods for CVE-2026-48806
Indicators of Compromise
- Sandboxed Twig templates containing mapping literals with dynamic key expressions such as { (userObject): value }
- Application logs showing __toString() invocations on classes not listed in the sandbox allowed_methods policy
- Unexpected calls into Stringable implementations during template rendering under SandboxExtension
Detection Strategies
- Inventory all Twig installations and flag versions below 3.27.0 in software composition analysis output
- Grep template repositories for parenthesized dynamic keys inside mapping literals rendered in sandbox mode
- Add runtime assertions or logging inside sensitive __toString() implementations to surface unexpected invocations during template rendering
Monitoring Recommendations
- Monitor PHP error and audit logs for sandbox security policy denials that appear only after upgrading, indicating previously bypassed calls
- Track dependency manifests such as composer.lock for twig/twig version drift across environments
- Alert on new template uploads or edits by low-privilege users in multi-tenant CMS platforms that expose Twig authoring
How to Mitigate CVE-2026-48806
Immediate Actions Required
- Upgrade twig/twig to version 3.27.0 or later across all affected applications
- Audit which user roles can author or upload Twig templates rendered under SandboxExtension
- Review the sandbox security policy and minimize the set of Stringable classes reachable from template context
Patch Information
The fix is included in Twig 3.27.0. ArrayExpression now implements CoercesChildrenToStringInterface, which routes dynamic mapping keys through the sandbox-aware string coercion path so SandboxExtension::ensureToStringAllowed() is invoked before PHP's implicit __toString() call. See the GitHub Security Advisory GHSA-5v5v-ww74-355v and the Twig v3.27.0 release notes for details.
Workarounds
- Disable untrusted template authoring until the upgrade to 3.27.0 is deployed
- Remove or wrap sensitive Stringable objects before exposing them to sandboxed template contexts
- Tighten the sandbox SecurityPolicy to restrict class and method exposure to the minimum required by templates
# Upgrade Twig to the patched release
composer require twig/twig:^3.27.0
composer update twig/twig
# Verify installed version
composer show twig/twig | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
