[CVE-2026-48805] Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/…

Descripción técnica

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

Puntuación CVSS

Score: 9.1/10 — Severidad: CRITICAL — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Productos afectados

Twig — Symfony

Debilidades (CWE)

CWE-693

Fuente oficial

Publicado en NIST NVD.