VulnSocial

CVE-2026-48808Disclosure(symfony / twig)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

symfony CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-693CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • twig

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-06-30); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
symfony
Products
twig

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-06-30: 1Mentions · 2026-07-15: 1Technical Details · 2026-06-30: 1Technical Details · 2026-07-15: 106-3007-15
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-301
Disclosure1
2026-07-151
General1
Full discourse2 posts
  • DailyCVE@dailycve
    Disclosure

    🟠 Twig (PHP templating engine), Sandbox Property Allowlist Bypass via SourcePolicyInterface, #CVE-2026-48808 (Medium) -DC-Jun2026-755 https://dailycve.com/twig-php-templating-engine-sandbox-property-allowlist-bypass-via-sourcepolicyinterface-cve-2026-48808-medium-dc-jun2026-755/

    Post summary

    The post announces a Medium‑severity vulnerability (CVE‑2026‑48808) in Twig’s sandbox property allowlist mechanism, providing basic technical details but no PoC, exploit code, or patch information.

    0001042
    217 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-48808 Sandbox Policy Bypass in Twig Column Filter Prior to Version 3.27.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-48808 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3

    Post summary

    The post announces CVE-2026-48808, describing a sandbox policy bypass in Twig's column filter before version 3.27.0, and links to a vulnerability details page and alert, but provides no PoC, exploit, or patch information.

    0000098
    4.1K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsymfonytwig---

Explore more

Back to dashboardsymfony CVEstwig vulnerabilities