Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-46634: Twig: Using template_from_string() can bypass security sandbox
CVE-2026-46634 · published 3 months ago
Summary
A security setting in Twig allows certain templates to access sensitive features, which can be exploited by attackers. To prevent this, Twig developers should avoid using the template_from_string() function in sandboxed environments, and instead remove the StringLoaderExtension when a security sandbox is in use. This will ensure that templates are properly secured and cannot access unauthorized features.
What to do
- Update twig twig to version 3.26.0.
- Update debian php-twig to version 3.27.0-0+deb13u1.
- Update debian php-twig to version 3.26.0-1.
- Update symfony twig to version 3.26.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | twig | twig |
>= 3.9.0, < 3.26.0 Fix: upgrade to 3.26.0
|
| Ubuntu:Pro:20.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | php-twig | All versions |
| Ubuntu:25.10 | canonical | php-twig | All versions |
| Ubuntu:26.04:LTS | canonical | php-twig | All versions |
| – | twigphp | twig | >= 3.9.0, < 3.26.0 |
| Debian:13 | debian | php-twig |
< 3.27.0-0+deb13u1 Fix: upgrade to 3.27.0-0+deb13u1
|
| Debian:14 | debian | php-twig |
< 3.26.0-1 Fix: upgrade to 3.26.0-1
|
| – | symfony | twig |
>= 3.9.0, < 3.26.0 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* |
Original advisory text
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
References
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-20...
- https://symfony.com/cve-2026-46634
- https://github.com/advisories/GHSA-24x9-r6q4-q93w
- https://ubuntu.com/security/CVE-2026-46634 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46634 Third Party Advisory
- https://symfony.com/blog/cve-2026-46634-template-from-string-escapes-a-sourcepol... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-46634 Vendor Advisory
- https://github.com/twigphp/Twig/releases/tag/v3.26.0 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46634... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46634 Vendor Advisory
- https://github.com/twigphp/Twig/security/advisories/GHSA-24x9-r6q4-q93w Vendor Advisory
- https://github.com/twigphp/Twig/commit/1cde8f2b62463f85d47995fc25f8241cb409d915 Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-693Protection Mechanism Failure
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen21 May 2026
Sources
GHSA-24x9-r6q4-q93w · GHSA
CVE-2026-46634 · NVD
CVE-2026-46634 · MITRE
CVE-2026-46634 · OSV
UBUNTU-CVE-2026-46634 · OSV
DEBIAN-CVE-2026-46634 · OSV
Track software like this
Free during beta