CVE-2026-46639 Details
Description
Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. This issue is fixed in version 3.26.0.
A vulnerability in Twig versions 3.24.0 prior to 3.26.0 allows for a sandbox bypass through object-destructuring assignment. The issue arises because the syntax compiles the `CoreExtension::getAttribute()` method with the sandbox argument hardcoded to false. This disables the property and method policy checks of the sandbox, enabling an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. The vulnerability exploits a common configuration where the `{% do %}` tag is allowed.
Users can upgrade to Twig version 3.26.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/twigphp/Twig/releases/tag/v3.26.0 | [email protected] | Release Notes |
| https://github.com/twigphp/Twig/security/advisories/GHSA-mm6w-gr99-p3jj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| symfony twig | >= 3.24.0, < 3.26.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | Initial Analysis | [email protected] |
| Jul 15, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |