Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-46640: Twig templates may execute attacker‑controlled PHP code
CVE-2026-46640 · published 3 months ago
Summary
Versions 3.15.0 through 3.26.0 of the Twig template engine allow a specially crafted template to insert attacker‑controlled text that becomes raw PHP and runs when the template loads. This can let an attacker run any code on the server hosting the application. Update Twig to version 3.26.0 or later to stop the problem.
What to do
- Update debian php-twig to version 3.27.0-0+deb13u1.
- Update twig twig to version 3.26.0.
- Update twig twig/twig to version 3.26.0.
- Update debian php-twig to version 3.26.0-1.
- Update symfony twig to version 3.26.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | php-twig |
< 3.27.0-0+deb13u1 Fix: upgrade to 3.27.0-0+deb13u1
|
| composer | twig | twig |
>= 3.15.0, < 3.26.0 Fix: upgrade to 3.26.0
|
| Packagist | twig | twig/twig |
>= 3.15.0, < 3.26.0 Fix: upgrade to 3.26.0
|
| Ubuntu:Pro:20.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | php-twig | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | php-twig | All versions |
| Ubuntu:25.10 | canonical | php-twig | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | php-twig | All versions |
| – | twigphp | twig | >= 3.15.0, < 3.26.0 |
| Debian:14 | debian | php-twig |
< 3.26.0-1 Fix: upgrade to 3.26.0-1
|
| – | symfony | twig |
>= 3.15.0, < 3.26.0 cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:* |
Original advisory text
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
References
- https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8 Vendor Advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-20...
- https://symfony.com/cve-2026-46640
- https://ubuntu.com/security/CVE-2026-46640 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-46640 Third Party Advisory
- https://symfony.com/blog/cve-2026-46640-arbitrary-php-code-execution-via-self-st... Third Party Advisory
- https://github.com/advisories/GHSA-45vw-wh46-2vx8
- https://github.com/twigphp/Twig Product
- https://github.com/vladko312/extras/blob/main/CVE-2026-46640.py
- https://github.com/twigphp/Twig/releases/tag/v3.26.0 URL
- https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2 Patch
- https://security-tracker.debian.org/tracker/CVE-2026-46640 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-46640 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46640... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-94Code Injection
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen21 May 2026
Sources
UBUNTU-CVE-2026-46640 · OSV
GHSA-45vw-wh46-2vx8 · GHSA
CVE-2026-46640 · NVD
GHSA-45vw-wh46-2vx8 · OSV
CVE-2026-46640 · MITRE
DEBIAN-CVE-2026-46640 · OSV
CVE-2026-46640 · OSV
Track software like this
Free during beta