Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-48805 Sandbox Bypass in Twig Template Language Prior to Version 3.27.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48805
Post summary
The text reports a newly disclosed sandbox bypass vulnerability in Twig Template Language affecting versions before 3.27.0, without mentioning PoCs, exploits, patches, or active exploitation.
🟠 Twig (PHP Template Engine), Sandbox Bypass via Deprecated Internal Wrappers, #CVE-2026-48805 (Medium) -DC-Jun2026-760 https://dailycve.com/twig-php-template-engine-sandbox-bypass-via-deprecated-internal-wrappers-cve-2026-48805-medium-dc-jun2026-760/
Post summary
DailyCVE announced a Medium‑severity sandbox bypass vulnerability (CVE‑2026‑48805) in Twig PHP Template Engine caused by deprecated internal wrappers, providing disclosure details but no PoC, exploit, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |