CVE-2026-46636

Received Received - Intake

Markup Subclass Method Bypass in Twig Template Engine

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-46636

Affected Vendors & Products

Vendor	Product	Version / Range
twig	twig	to 3.27.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

This vulnerability affects Twig, a PHP template language. It allows method calls on instances of Twig\Markup to bypass security restrictions. The issue occurs because SecurityPolicy::checkMethodAllowed() whitelists all methods on Markup objects, including subclasses. Attackers can exploit this to call any public method on a Markup-derived object passed into a sandboxed template.

Detection Guidance

This vulnerability affects Twig versions 1.0.0 to before 3.27.0. To detect it, check your Twig version with: composer show twig/twig. If the version is below 3.27.0, the system is vulnerable. Additionally, inspect custom Markup subclasses for public methods that could be exposed in sandboxed templates.

Impact Analysis

If you use Twig versions 1.0.0 to before 3.27.0, an attacker could execute arbitrary code or access sensitive data by passing a malicious Markup-derived object into a sandboxed template. This could lead to data breaches, unauthorized actions, or further system compromise depending on the application's context.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected Twig versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Twig to version 3.27.0 or later to patch the vulnerability. Review any custom subclasses of Twig\Markup in your application to ensure they do not expose unintended methods.

Hi! I’m here to help you understand CVE-2026-46636. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70