GHSA-h8vq-8gpg-mhcg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-h8vq-8gpg-mhcg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-h8vq-8gpg-mhcg/GHSA-h8vq-8gpg-mhcg.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-h8vq-8gpg-mhcg
- Aliases
- Published
- 2026-06-30T18:43:45Z
- Modified
- 2026-08-24T00:36:56Z
- Summary
- Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterface`
- Details
-
Description
This is a residual bypass of CVE-2026-46635 / GHSA-vcc8-phrv-43wj that only affects sandboxing enabled through
SourcePolicyInterface(and not the regular global sandbox mode).CoreExtension::column()receives the active sandbox state via theneeds_is_sandboxedchannel as a boolean$isSandboxed, but then routes the per-element property reads throughSandboxExtension::checkPropertyAllowed()without forwarding the currentSource.SandboxExtension::checkPropertyAllowed()re-evaluatesisSandboxed($source)internally; with$source = nulltheSourcePolicyInterface-driven decision is lost, the method short-circuits to "not sandboxed", and the property allowlist is never consulted.A template author whose sandbox is gated by a
SourcePolicyInterfaceand who hascolumnon theirallowedFilterslist can therefore read any public or magic property of any object reachable in the render context, regardless ofSecurityPolicy::$allowedProperties. Direct attribute access to the same property is blocked, and the same payload is also blocked under global sandbox mode, which makes this a clear policy enforcement gap rather than a configuration issue.Resolution
CoreExtension::column()no longer goes through theSandboxExtensionwrapper for the property check. It calls the security policy directly: the per-source decision is already captured by the$isSandboxedboolean computed at the call site, so the property allowlist is enforced consistently for both global and source-policy sandboxing.Credits
Twig would like to thank Vincent55 Yang for reporting the issue and Fabien Potencier for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-693", "CWE-863" ], "github_reviewed": true, "github_reviewed_at": "2026-06-30T18:43:45Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/twigphp/Twig/security/advisories/GHSA-h8vq-8gpg-mhcg
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-48808.yaml
- https://github.com/twigphp/Twig
- https://github.com/twigphp/Twig/releases/tag/v3.27.0
- https://symfony.com/blog/cve-2026-48808-sandbox-property-allowlist-bypass-via-the-column-filter-under-sourcepolicyinterface
Affected packages
Packagist / twig/twig
Package
- Name
- twig/twig
- Purl
- pkg:composer/twig/twig
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed3.27.0