Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2026-48807 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2026-48807

CVE-2026-48807

CRITICAL9.1

Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters

Published Jul 14, 2026

Modified 1 weeks ago

Details

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

References

https://github.com/twigphp/Twig/releases/tag/v3.27.0

https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c

https://www.cve.org/CVERecord?id=CVE-2026-48807

CVSS Analysis

CVSS v4.0

7.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

LowVI:L

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

7.1/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Weakness Type (CWE)

Access Control

Incorrect Authorization

Other

Ecosystems

Timeline

PublishedJul 14, 2026

ModifiedJul 15, 2026