CVE-2026-48805 in home-assistant
Summary
by MITRE • 07/15/2026
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/15/2026
The vulnerability described affects the Twig template engine for PHP, specifically impacting versions prior to 3.27.0 where deprecated internal wrappers fail to properly forward sandbox state information to critical core extension functions. This represents a significant security flaw that undermines the intended sandboxing mechanisms designed to prevent unauthorized code execution within template contexts. The issue stems from improper state propagation within the core.php resource file where legacy wrapper functions do not maintain the necessary security context when invoking CoreExtension methods.
The technical flaw manifests in the failure of three specific functions - CoreExtension::checkArrow(), arraySome(), and arrayEvery() - to receive proper sandbox state information from their deprecated wrapper counterparts. This breakdown allows legacy function calls including twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to circumvent the established security boundaries that should restrict callable operations within sandboxed environments. The vulnerability creates an attack surface where malicious template code could potentially exploit these bypass mechanisms to execute unauthorized operations that would normally be restricted by the sandbox implementation.
From an operational impact perspective, this vulnerability compromises the fundamental security model of Twig's sandboxing system, which is designed to prevent template authors from executing arbitrary PHP code or accessing restricted functions. Attackers could leverage this flaw to bypass security controls and potentially escalate privileges within applications that rely on Twig for template rendering. The risk is particularly concerning in multi-tenant environments or applications where untrusted users can submit templates, as the bypass allows for unauthorized access to system resources that should remain protected.
The fix implemented in version 3.27.0 addresses this by ensuring proper state forwarding between deprecated wrappers and core extension functions, thereby restoring the intended security boundaries within the sandbox implementation. This remediation aligns with security best practices for maintaining consistent state management across function call chains and demonstrates proper adherence to secure coding principles that prevent information flow vulnerabilities.
This vulnerability type maps to CWE-250: "Execute Code from Untrusted Input" and CWE-345: "Insufficient Verification of Data Authenticity". The attack surface aligns with ATT&CK techniques involving privilege escalation through sandbox bypasses and code injection. Organizations should prioritize updating to version 3.27.0 or later, implement proper template validation procedures, and conduct security reviews of template rendering components to ensure complete remediation of this sandbox integrity issue.