Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-48806

Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

twigphp Twig

  • < 3.27.0affected

References