CVE-2026-48807: Critical Sandbox Bypass in Twig join, replace and in

CVE-2026-48807 is a critical sandbox bypass (CVSS 9.1) in Twig. Before 3.27.0, the sandbox string checks did not cover Traversable values given to the join and replace filters, or operands of the in and not in operators. Upgrade to Twig 3.27.0 if untrusted users write sandboxed templates.

What's affected

Twig 3.26.0 and earlier, patched in 3.27.0.

The issue matters for applications that run untrusted template code in the sandbox. The advisory says the gap covers two spots: Traversable values passed to join and replace, and the in and not in operators, with both array and Traversable haystacks.

How to check if you're exposed

Check the installed version and whether you use the sandbox.

composer show twig/twig
composer why twig/twig

The second command shows which packages, such as Symfony bundles, pull Twig in. Check the sandbox: search your code for SandboxExtension or SecurityPolicy, because only sandboxed templates are in scope.

What to do now

1. Run composer update twig/twig and confirm the installed version is 3.27.0 or later.
2. Redeploy, and clear template caches so compiled templates are rebuilt.
3. If you let users or editors author templates, review what objects and methods your sandbox policy exposes to them.
4. Keep the sandbox policy as narrow as you can, whatever the version.

Why it matters

The classes are CWE-693, protection mechanism failure, and CWE-863, incorrect authorization. The sandbox already checked string conversion inside arrays but stopped at Traversable objects, whose contents are only read later by functions that convert them to strings. The in operator falls back to a PHP comparison that also converts objects to strings.

The advisory adds a point worth remembering: the in operator can act as a content oracle. Each comparison leaks one bit about the string, and chained comparisons could rebuild a value even when every method is denied. So a bypass can leak data without direct output. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.

Paste your lockfile or manifest into the free in-browser dependency scan to see whether twig/twig is in your tree, including as a transitive dependency. Reachability analysis can then show whether your code calls the affected path, which helps you order the work.

Quick check

Sources

• Twig v3.27.0 release notes
• Twig security advisory GHSA-8x9c-rmqh-456c

Last reviewed: 19 October 2026.