CVE-2026-48806 is a critical sandbox policy bypass (CVSS 9.1) in Twig, the PHP template engine. Before 3.27.0, a dynamic mapping key that is a Stringable object could have its string conversion run without the sandbox check. Upgrade to Twig 3.27.0 if you let untrusted people write sandboxed templates.
What's affected
Twig 3.26.0 and earlier. The patched version is 3.27.0.
It matters if you run templates written by people you do not fully trust inside Twig's sandbox, such as customer editable email or page templates. If only your developers write templates, the sandbox is not your security boundary and exposure is lower.
How to check if you're exposed
Check the installed Twig version and find out whether you use the sandbox at all.
composer show twig/twig
composer why twig/twig
The second command shows which packages, such as Symfony bundles, pull Twig in. Check the sandbox: search your code for SandboxExtension or SecurityPolicy, because only sandboxed templates are in scope.
What to do now
- Run
composer update twig/twigand confirm the installed version is 3.27.0 or later. - Redeploy, and clear template caches so compiled templates are rebuilt.
- If you let users or editors author templates, review what objects and methods your sandbox policy exposes to them.
- Keep the sandbox policy as narrow as you can, whatever the version.
Why it matters
The classes are CWE-693, protection mechanism failure, and CWE-863, incorrect authorization. The sandbox is meant to check a policy before an object is converted to a string. A dynamic mapping key was converted by PHP directly, so the policy was never asked. This is a leftover gap from an earlier fix for an unguarded string conversion, and the advisory calls the demonstrated impact disclosure of data returned by an object's string method.
The fix declares mapping keys as places where string conversion happens, so the sandbox wraps them with the policy check. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
Paste your lockfile or manifest into the free in-browser dependency scan to see whether twig/twig is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the sandbox the only protection I should use?
No. Treat the sandbox as one layer, keep the policy tight, and avoid exposing objects with sensitive string conversions to template authors.
Sources
Last reviewed: 19 October 2026.
