CVE-2026-46640 twigphp CVE debrief

Who should care

Developers and administrators using Twig template language for PHP, especially those with applications vulnerable to remote code execution, should be aware of this vulnerability. They should review and validate user-controlled input in templates, implement additional security measures to monitor and restrict template loading, and update Twig to version 3.26.0 or later.

Technical summary

A vulnerability in Twig template language for PHP, versions 3.15.0 to 3.25.0, allows an attacker to inject and execute arbitrary PHP code due to improper validation of dynamic attribute syntax in MacroReferenceExpression names. This issue is caused by the concatenation of an attacker-controlled string into a MacroReferenceExpression name without identifier validation, resulting in raw PHP being emitted into the generated template source and executed at template-load time. The vulnerability has a high impact due to the potential for remote code execution.

Defensive priority

High priority due to remote code execution risk.

Recommended defensive actions

• Update Twig to version 3.26.0 or later
• Review and validate user-controlled input in templates
• Implement additional security measures to monitor and restrict template loading
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. Evidence is limited, and defenders should verify the vulnerability's impact on their systems, especially those using Twig template language for PHP versions 3.15.0 to 3.25.0. Additional verification tasks include reviewing user-controlled input in templates and monitoring template loading.

Official resources