CVE-2026-46634 Details
Description
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
A vulnerability exists in the Twig template language for PHP, specifically in versions 3.9.0 prior to 3.26.0. The issue arises when the sandbox is selectively enabled through the SourcePolicyInterface. In this scenario, a sandboxed template allowed to use the template_from_string and include functions can render an arbitrary inner template without proper security policy enforcement. The inner template is compiled under a synthesized name that evades the SourcePolicyInterface sandbox decision, allowing potential exploitation by accessing sensitive information or executing commands.
Users should upgrade to Twig version 3.26.0, where this vulnerability is fixed. Additionally, when using a SourcePolicyInterface, template_from_string should not be allowed in the sandboxed environment. The safest option is to avoid registering the StringLoaderExtension when a sandbox is in use.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| symfony twig | >= 3.9.0, < 3.26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |