SEPTEMBER 11, 2026
Live Feed
Back to database
Case File

CVE-2026-48805

CRITICAL · CVSS 9.1 EPSS 0.27% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-14 · Last synced 2026-08-13

CyberRota Analysis

AI-Generated

The vulnerability affects the Twig template engine for PHP, allowing legacy functions to bypass sandbox restrictions due to improper handling of the current sandbox state. This could lead to unauthorized code execution within the sandboxed environment, posing a significant security risk. Organizations using affected versions prior to 3.27.0 should prioritize upgrading to mitigate potential exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-48805
Severity
CRITICAL
CVSS
9.1
EPSS
0.27%

Original NVD Description

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

Related CVEs

Other vulnerabilities affecting the same vendor(s)