CVE-2026-46638 twigphp CVE debrief

Who should care

Users of Twig template language for PHP, particularly those using versions prior to 3.26.0, should be aware of this security bypass vulnerability and review their deployments for potential exposure.

Technical summary

A security bypass vulnerability exists in Twig template language for PHP, versions prior to 3.26.0. The {% sandbox %}{% include %} construct can include a template previously loaded outside the sandbox without re-invoking checkSecurity(), potentially allowing the cached template to use denied tags, filters, and functions. This issue is fixed in version 3.26.0. Affected users of Twig template language for PHP should review their deployments for potential exposure, particularly those using versions prior to 3.26.0, and consider upgrading to mitigate this security bypass vulnerability.

Defensive priority

Medium priority, as the vulnerability has a CVSS score of 6 and is classified as MEDIUM severity.

Recommended defensive actions

• Upgrade to Twig version 3.26.0 or later
• Review and update template usage to ensure sandboxing
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, while the vendor advisory and patch notes offer guidance on mitigation. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems, review vendor guidance, and monitor for potential exploitation attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.