GHSA-p42q-9prx-q5wq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p42q-9prx-q5wq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p42q-9prx-q5wq/GHSA-p42q-9prx-q5wq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p42q-9prx-q5wq
- Aliases
- Published
- 2026-06-30T18:41:30Z
- Modified
- 2026-09-10T03:51:09Z
- Summary
- Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
- Details
-
Description
The 3.26.0 source-policy hardening changed the signature of
CoreExtension::checkArrow()to take a boolean$isSandboxedinstead of anEnvironment, and added the same$isSandboxedargument toCoreExtension::arraySome()andCoreExtension::arrayEvery(). Compiled templates were updated to pass the per-source sandbox state computed at the call site.The deprecated internal wrappers exposed in
src/Resources/core.phpfor legacy third-party code (twig_check_arrow_in_sandbox(),twig_array_some(),twig_array_every()) were not updated:twig_array_some()andtwig_array_every()callCoreExtension::arraySome()/arrayEvery()without forwarding the sandbox state. The underlying methods default$isSandboxedtofalse, so the callable-must-be-a-Closurerestriction is silently bypassed in sandbox mode and a string callable such as'strcmp'is accepted.twig_check_arrow_in_sandbox()passes theEnvironmentobject whereCoreExtension::checkArrow()now expects abool, which throws aTypeErroron PHP 8+.
Compiled Twig templates are not affected: they call
CoreExtension::*directly with the correct arguments. Applications are only impacted if they still call the deprecatedtwig_*helpers on top of a sandboxedEnvironment.Resolution
The three wrappers now resolve the current sandbox state via
twig_resolve_is_sandboxed()(the same helper compiled templates use), and forward it to the correspondingCoreExtension::*method.twig_check_arrow_in_sandbox()no longer triggers aTypeError, andtwig_array_some()/twig_array_every()now enforce the same sandbox restriction as compiled templates.Credits
We would like to thank El Kharoubi Iosif for reporting the issue and Fabien Potencier for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-693" ], "github_reviewed": true, "github_reviewed_at": "2026-06-30T18:41:30Z", "nvd_published_at": null, "severity": "LOW" }- References
-
- https://github.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wq
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48805.yaml
- https://github.com/twigphp/Twig
- https://github.com/twigphp/Twig/releases/tag/v3.27.0
- https://symfony.com/blog/cve-2026-48805-sandbox-state-regression-in-deprecated-internal-wrappers-in-src-resources-core-php
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig/twig
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.27.0