CVE-2026-48805

Katalog CVE

CVSS 9.1 · Critical EPSS 0,48%

Kerentanan Protection Mechanism Failure pada symfony twig. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/twigphp/Twig/security/advisories/GHSA-p42q-9prx-q5wq advisory vendor
• https://github.com/twigphp/Twig/commit/e235cae3a1d1e23edc24df4d675f18108c6b167b patch
• https://github.com/twigphp/Twig/releases/tag/v3.27.0 release notes