GHSA-5v5v-ww74-355v
Suggest an improvement- Source
- https://github.com/advisories/GHSA-5v5v-ww74-355v
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-5v5v-ww74-355v/GHSA-5v5v-ww74-355v.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-5v5v-ww74-355v
- Aliases
- Published
- 2026-06-30T18:42:49Z
- Modified
- 2026-09-10T03:50:48Z
- Summary
- Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys
- Details
-
Description
This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded
__toString()calls.In 3.26.0 the sandbox visitor was extended to wrap every child node that its parent will string-coerce at runtime with
CheckToStringNode, gated by the newCoercesChildrenToStringInterface.ArrayExpressiondid not implement the interface for its mapping keys: when a dynamic key expression resolves to aStringableobject,ArrayExpression::compile()emits a raw(string)cast (viaStringCastUnaryforContextVariablekeys, and no cast at all for richer key expressions). PHP then invokes__toString()directly, without ever callingSandboxExtension::ensureToStringAllowed().A sandboxed template author can therefore trigger
__toString()on any object reachable in the render context by using it as a dynamic mapping key, for example:{% set arr = {(obj): "value"} %}Direct output of the same object is correctly blocked, which makes this a clear policy enforcement gap. The reliable demonstrated impact is unauthorised disclosure of data returned by
__toString().Resolution
ArrayExpressionnow declares its dynamic mapping keys as string-coercion sites throughCoercesChildrenToStringInterface, so the sandbox visitor wraps them withCheckToStringNodeand the policy is consulted before PHP coerces the key to a string. The compiler also keeps an explicit(string)cast around the wrapped expression so PHP type errors on non-string keys are preserved.As a side effect, any expression is now accepted as a dynamic mapping key (not only context variables); this is documented as a new feature on the 3.x branch.
Credits
Twig would like to thank El Kharoubi Iosif for reporting the issue and Fabien Potencier for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-693", "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-06-30T18:42:49Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/twigphp/Twig/security/advisories/GHSA-5v5v-ww74-355v
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48806.yaml
- https://github.com/twigphp/Twig
- https://github.com/twigphp/Twig/releases/tag/v3.27.0
- https://symfony.com/blog/cve-2026-48806-sandbox-tostring-policy-bypass-via-dynamic-mapping-keys
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig/twig
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.27.0