CVE-2026-46634 twigphp CVE debrief

Who should care

Users of Twig template language for PHP, particularly those using versions between 3.9.0 and 3.26.0, should be aware of this vulnerability. This includes developers, system administrators, and security teams responsible for maintaining and securing applications that utilize Twig. Reviewing and adjusting sandbox configurations to ensure proper security policy enforcement is crucial. Additionally, monitoring for and addressing potential exploitation attempts is recommended.

Technical summary

A vulnerability in Twig template language for PHP, versions between 3.9.0 and 3.26.0, allows a sandboxed template to render an inner template without security policy enforcement via the template_from_string() function. This issue arises because the template_from_string() function compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision. This could potentially allow for unauthorized access or execution of code within the sandboxed environment.

Defensive priority

High priority due to CVSS score of 7.7 and potential for exploitation

Recommended defensive actions

• Update Twig to version 3.26.0 or later
• Review and adjust sandbox configurations to ensure proper security policy enforcement
• Monitor for and address potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official CVE and NVD sources indicates a vulnerability in Twig template language for PHP, affecting versions between 3.9.0 and 3.26.0. The issue allows a sandboxed template to render an inner template without security policy enforcement via the template_from_string() function. Limited details are available, and further investigation is recommended. Additional review of vendor documentation and security advisories is necessary to understand the full scope of this vulnerability.

Official resources