CVE-2026-46634: Twig: Using template_from_string() can bypass security sandbox

Summary

A security setting in Twig allows certain templates to access sensitive features, which can be exploited by attackers. To prevent this, Twig developers should avoid using the template_from_string() function in sandboxed environments, and instead remove the StringLoaderExtension when a security sandbox is in use. This will ensure that templates are properly secured and cannot access unauthorized features.

What to do

Update twig twig to version 3.26.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
composer	twig	twig	>= 3.9.0, < 3.26.0 Fix: upgrade to 3.26.0
–	twigphp	twig	>= 3.9.0, < 3.26.0
–	symfony	twig	>= 3.9.0, < 3.26.0 `cpe:2.3:a:symfony:twig::::::::`

Original title

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePoli...

Original description

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.

Vulnerability type

CWE-693 Protection Mechanism Failure