CVE-2026-46633

Analyzed Analyzed - Analysis Complete

Twig Template Engine PHP Code Injection via Single-Quoted String

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-46633

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. A vulnerability exists in versions before 3.26.0 where the Compiler::string() function fails to escape single quotes in template names from {% use %} tags when placed inside PHP single-quoted strings. This allows attackers to terminate the string and inject arbitrary PHP code into the compiled cache file.

Detection Guidance

To detect this vulnerability, check if your Twig version is below 3.26.0. Run: composer show twig/twig. If the version is older, update immediately. Inspect compiled cache files for unexpected PHP expressions, especially in files generated from templates using {% use %} tags.

Impact Analysis

An attacker could exploit this to execute arbitrary PHP code on your server if they can control a template name. This could lead to full system compromise, data theft, or unauthorized actions depending on the server's permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Compliance may be compromised if exploited, potentially resulting in legal penalties or data breaches.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later to address the vulnerability in Compiler::string().

Hi! I’m here to help you understand CVE-2026-46633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70