CVE-2026-46638

Analyzed Analyzed - Analysis Complete

Remote Code Execution in Twig Template Engine

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-03

NVD

CVE-2026-46638

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. A flaw exists where {% sandbox %}{% include %} can load a template outside the sandbox without reapplying security checks. This allows cached templates to use restricted tags, filters, or functions that should have been blocked by SecurityPolicy::checkSecurity(). The issue is fixed in version 3.26.0.

Detection Guidance

Detecting this vulnerability requires checking the Twig version in use. Run: php -r "echo Twig\Environment::VERSION . PHP_EOL;" to verify if the installed version is below 3.26.0. If it is, the system is vulnerable.

Impact Analysis

An attacker could exploit this to bypass security restrictions in Twig templates. This may lead to unauthorized code execution, data leaks, or other malicious actions depending on the application's use of Twig.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a PHP template engine sandbox bypass. Compliance impacts would depend on how the affected Twig library is used in a specific application handling regulated data.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later immediately. Use Composer to update: composer require twig/twig:^3.26.0. After updating, review templates using {% sandbox %} and {% include %} to ensure security policies are enforced correctly.

Hi! I’m here to help you understand CVE-2026-46638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70