CVE-2026-48805 is a critical sandbox bypass (CVSS 9.1) in the PHP template engine Twig. Before version 3.27.0, deprecated wrapper functions did not pass the sandbox state on. Upgrade to Twig 3.27.0. Only applications that call the deprecated twig_ helpers on a sandboxed environment are affected.
What's affected
Twig 3.26.0 and earlier, as the GitHub advisory states it. The patched version is 3.27.0.
The advisory is specific that compiled Twig templates are not affected. You are in scope only if your own or third party code still calls the deprecated helpers twig_array_some(), twig_array_every() or twig_check_arrow_in_sandbox() on an environment that uses the sandbox.
How to check if you're exposed
Check the installed version, then search for the helpers.
composer show twig/twig
composer why twig/twig
The second command shows which packages, such as Symfony bundles, pull Twig in. Check the sandbox: search your code for SandboxExtension or SecurityPolicy, because only sandboxed templates are in scope.
grep -rnE 'twig_array_some|twig_array_every|twig_check_arrow_in_sandbox' src vendor
A match outside Twig itself means some code still uses the deprecated helpers.
What to do now
- Run
composer update twig/twigand confirm the installed version is 3.27.0 or later. - Redeploy, and clear template caches so compiled templates are rebuilt.
- If you let users or editors author templates, review what objects and methods your sandbox policy exposes to them.
- Keep the sandbox policy as narrow as you can, whatever the version.
Why it matters
The class is CWE-693, protection mechanism failure. The 3.26.0 hardening changed how sandbox state is passed to the array helper methods. The deprecated wrappers kept the old call shape, so the state was dropped and the underlying methods defaulted to not sandboxed. The effect, per the advisory, is that a rule requiring a closure was skipped and a string callable such as the name of a PHP function was accepted.
This is a good example of how deprecated code paths can lag behind a security change. The fix makes the wrappers resolve the sandbox state the same way compiled templates do. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether twig/twig is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Quick check
Do ordinary Twig sites need to worry?
Only if they use the sandbox together with the deprecated helper calls. Upgrading is still low effort.
Sources
Last reviewed: 19 October 2026.
