We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-48807

CVE-2026-48807

PHP

Severity: —
CVSS: —CVSS
Published: 2026-07-14
Last modified: 2026-07-14
CWE: CWE-693CWE-863

Description

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

References

https://github.com/twigphp/Twig/releases/tag/v3.27.0
https://github.com/twigphp/Twig/security/advisories/GHSA-8x9c-rmqh-456c

Summary

Description

References