https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T09:30:46.397076+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-48806 CVE-2026-48806 — Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys 2026-10-07T09:30:46.415105+00:00

Affected: twigphp Twig

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.