Bug 2500755 (CVE-2026-48808)

Summary: CVE-2026-48808 twig/twig: Twig: Information Disclosure via Sandbox Bypass in Column Filter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Twig, a template language for PHP. The `column` filter in Twig fails to properly forward the active sandbox state, specifically the current `Source` to the `SandboxExtension::checkPropertyAllowed()` function. This oversight results in the loss of `SourcePolicyInterface` decisions, allowing a template author to bypass sandbox restrictions. Consequently, an attacker with template authoring capabilities can read public or magic properties that should otherwise be restricted by the sandbox policy, leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2500870, 2500871    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-14 22:04:58 UTC 
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.