CVE-2026-48805— twigphp Twig 处理逻辑错误漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-48805の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`
ソース: CVE Program / CVE List V5
脆弱性説明
Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
保护机制失效
ソース: CVE Program / CVE List V5
脆弱性タイトル
twigphp Twig 处理逻辑错误漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
twigphp Twig是twigphp的PHP模板引擎。 twigphp Twig 3.27.0之前版本存在处理逻辑错误漏洞，该漏洞源于src/Resources/core.php中的内部封装未传递当前沙箱状态，允许旧式调用绕过沙箱可调用项限制。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-48805の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-48805のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-48805 补丁与修复 (1)
CVE-2026-48805 厂商安全公告 (1)
CVE-2026-48805 厂商页面 (1)
Same Patch Batch · twigphp · 2026-07-14 · 17 CVEs total
| CVE-2026-46634 | 7.7 HIGH | Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized templ |
| CVE-2026-47730 | Twig: XSS in profiler HtmlDumper via unescaped template and profile names | |
| CVE-2026-47732 | Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points | |
| CVE-2026-48806 | Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys | |
| CVE-2026-48808 | Twig: Sandbox property allowlist bypass via the `column` filter under `SourcePolicyInterfa | |
| CVE-2026-48807 | Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filte | |
| CVE-2026-49981 | Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes betwee | |
| CVE-2026-46635 | Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects) | |
| CVE-2026-46638 | Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete f | |
| CVE-2026-46628 | Twig: The `spaceless` filter implicitly marks its output as safe | |
| CVE-2026-46640 | Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation | |
| CVE-2026-46637 | Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']` | |
| CVE-2026-46639 | Twig: Sandbox property and method bypass via object-destructuring assignment | |
| CVE-2026-46627 | Twig: Sandbox resource exhaustion via unbounded `for` / `range()` | |
| CVE-2026-46633 | Twig: PHP code injection via `{% use %}` template name | |
| CVE-2026-46629 | Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled argu |
IV. 関連脆弱性
同じ製品: Twig
- CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` - CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mappi - CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` fil - CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass whe - CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly decla
同じベンダー: twigphp
- CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` - CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mappi - CVE-2026-48808
Twig: Sandbox property allowlist bypass via the `column` fil - CVE-2026-49981
Twig: Sandbox filter, tag and function allow-list bypass whe - CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly decla
同じ弱点: CWE-693
- CVE-2026-48037
Hulumi: AccountFoundation reuse paths silently downgrade Gua - CVE-2026-48033
Hulumi: Policy packs bypassed by a forged Pulumi-URN logical - CVE-2026-65899
DOMPurify before 3.4.9 Trusted Types Policy State Contaminat - CVE-2026-46403
Klever-Go KVM read-only execution can commit contract delete - CVE-2026-56585
HCL IEM was affected with the Anti Clickjacking XFrame Optio
V. CVE-2026-48805へのコメント
まだコメントはありません