Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Twig templates may allow arbitrary PHP code execution

CVE-2026-46633 · published 3 months ago
Summary

Versions of the Twig template engine from 1.15.1 up to, but not including, 3.26.0 can be tricked into inserting malicious PHP code into its compiled cache files. An attacker could craft a template name that breaks the code and runs their own PHP commands, potentially compromising the server. Upgrade Twig to version 3.26.0 or later to fix the problem.

What to do
  • Update twig twig to version 3.26.0.
  • Update twig twig/twig to version 3.26.0.
  • Update debian php-twig to version 3.5.1-1+deb12u3.
  • Update debian php-twig to version 3.27.0-0+deb13u1.
  • Update debian php-twig to version 3.26.0-1.
  • Update twig twig/twig to version v3.11.3-p12007003+root.io.
  • Update twig twig/twig to version v3.11.3-p12007004+root.io.
  • Update twig twig/twig to version v3.11.3-p12007005+root.io.
  • Update symfony twig to version 3.26.0 or later.
Affected software
Ecosystem VendorProductAffected versions
composer twig twig < 3.26.0
>= 1.15.1, < 3.26.0
Fix: upgrade to 3.26.0
Packagist twig twig/twig < 3.26.0
Fix: upgrade to 3.26.0
Debian:11 debian php-twig All versions
Debian:12 debian php-twig < 3.5.1-1+deb12u3
Fix: upgrade to 3.5.1-1+deb12u3
Debian:13 debian php-twig < 3.27.0-0+deb13u1
Fix: upgrade to 3.27.0-0+deb13u1
Debian:14 debian php-twig < 3.26.0-1
Fix: upgrade to 3.26.0-1
Ubuntu:Pro:20.04:LTS canonical php-twig All versions
Ubuntu:Pro:22.04:LTS canonical php-twig All versions
Ubuntu:Pro:24.04:LTS canonical php-twig All versions
Ubuntu:25.10 canonical php-twig All versions
Ubuntu:Pro:26.04:LTS canonical php-twig All versions
– twigphp twig < 3.26.0
>= 1.15.1, < 3.26.0
– symfony twig < 3.26.0
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
Root:Composer twig twig/twig < v3.11.3-p12007003+root.io
< v3.11.3-p12007004+root.io
< v3.11.3-p12007005+root.io
Fix: upgrade to v3.11.3-p12007003+root.io
Original advisory text
Twig: PHP code injection via `{% use %}` template name
Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published14 Jul 2026
Updated5 Nov 2026
First seen21 May 2026
Sources
DEBIAN-CVE-2026-46633 · OSV
UBUNTU-CVE-2026-46633 · OSV
GHSA-7p85-w9px-jpjp · GHSA
CVE-2026-46633 · NVD
GHSA-7p85-w9px-jpjp · OSV
CVE-2026-46633 · MITRE
CVE-2026-46633 · OSV
ROOT-APP-COMPOSER-CVE-2026-46633 · OSV
Track software like this
Free during beta