CVE-2026-46634

Analyzed Analyzed - Analysis Complete

Remote Code Execution in Twig Template Engine

Publication date: 2026-07-14

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-29

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-46634

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	From 3.9.0 (inc) to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Twig, a PHP template language. Between versions 3.9.0 and 3.26.0, the template_from_string() function compiles inner templates under a generated name that bypasses sandbox security policies. This allows a sandboxed template to render another template without proper security checks.

Detection Guidance

To detect this vulnerability, check if your Twig version is between 3.9.0 and 3.26.0. Run: composer show twig/twig. If the version falls in this range, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute unauthorized code or access sensitive data by bypassing intended security restrictions in Twig templates. This may lead to data breaches or system compromise depending on the application's use of Twig.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data access or processing, potentially leading to breaches of GDPR or HIPAA. Organizations using affected Twig versions may face regulatory penalties if exploited.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later immediately. Use: composer require twig/twig:^3.26.0. Review templates using template_from_string() for potential misuse.

Hi! I’m here to help you understand CVE-2026-46634. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70