CVE-2026-48805: Twig Sandbox Bypass Missing Statecve-2026-48805-twig-sandbox-bypass-missing-state
A call to a Twig `CoreExtension` array or arrow checking method is missing the explicit `$isSandboxed` parameter or providing an Environment directly instead of resolving the sandbox state. This allows arbitrary PHP functions to bypass the sandbox check, leading to potential Remote Code Execution. Explicitly resolve the sandbox state using `twig_resolve_is_s
