CVE-2026-46633: Twig: PHP Code Injection via Malformed Template Names

Summary

A security flaw in Twig allows attackers to inject malicious PHP code into templates. This can lead to unauthorized access to sensitive data and potentially allow attackers to execute code on the server. To protect against this, Twig has been updated to properly escape single quotes in template names, preventing the injection of malicious code.

What to do

Update twig twig to version 3.26.0.
Update twig twig/twig to version 3.26.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	twig	twig	< 3.26.0 Fix: upgrade to 3.26.0
Packagist	twig	twig/twig	< 3.26.0 Fix: upgrade to 3.26.0
–	twigphp	twig	< 3.26.0
–	symfony	twig	< 3.26.0 `cpe:2.3:a:symfony:twig::::::::`

Original title

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal,...

Original description

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

ghsa CVSS4.0 9.3

Vulnerability type

CWE-94 Code Injection