5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48805

CVE-2026-48805: Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48805

CVE-2026-48805:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
twig/twig	composer	<= 3.26.0	3.27.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in three deprecated wrapper functions (twig_array_some, twig_array_every, and twig_check_arrow_in_sandbox) located in src/Resources/core.php. These functions were not updated correctly following a signature change in the underlying CoreExtension methods they call. Specifically, they fail to pass a boolean $isSandboxed flag that indicates whether the current execution context is sandboxed.

For twig_array_some and twig_array_every, the absence of this flag causes the called methods (CoreExtension::arraySome and CoreExtension::arrayEvery) to default to a non-sandboxed mode ($isSandboxed = false). This bypasses a critical security check that restricts callables to Closure objects when in sandbox mode, thereby allowing string representations of any PHP function to be called. An attacker could leverage this to execute arbitrary code.

For twig_check_arrow_in_sandbox, the function passes an entire Environment object instead of the expected boolean, leading to a TypeError and a failure of the intended security check. The analysis of the patch commit e235cae3a1d1e23edc24df4d675f18108c6b167b confirms these changes, where the vulnerable calls are replaced with versions that correctly resolve and forward the sandbox state using twig_resolve_is_sandboxed(\$env).

Vulnerable functions

twig_array_some

src/Resources/core.php

This deprecated wrapper function calls `CoreExtension::arraySome` without forwarding the sandbox state. The underlying method defaults the `$isSandboxed` parameter to `false`, which silently bypasses the restriction that callables must be a `Closure` in sandbox mode. This allows string callables like 'system' or 'exec' to be used, potentially leading to remote code execution.

twig_array_every

src/Resources/core.php

Similar to `twig_array_some`, this deprecated wrapper calls `CoreExtension::arrayEvery` without the necessary sandbox state. This causes the `$isSandboxed` parameter to default to `false`, disabling sandbox protections and allowing non-`Closure` callables to be executed, which could be exploited for arbitrary code execution.

twig_check_arrow_in_sandbox

src/Resources/core.php

This deprecated wrapper function passes an `Environment` object to `CoreExtension::checkArrow` where a boolean `$isSandboxed` is expected. This results in a `TypeError` on PHP 8+ and, more critically, constitutes a failure of the protection mechanism, as the sandbox check for arrow functions is not performed correctly. The fix involves resolving the sandbox state and passing it as a boolean.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.