CVE-2026-46633
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
Vulnerability in the Twig template engine for PHP before version 3.26.0. The Compiler::string() function does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing injection of arbitrary PHP code into the compiled cache file.
Risk Assessment
An attacker can exploit this vulnerability to achieve remote code execution (RCE) on the server, leading to full compromise of the application and potentially the entire system.
Recommendation
Immediately update the Twig library to version 3.26.0 or later. If an update is not possible, avoid using dynamic template names in the {% use %} tag.
Original NVD description (English source)
Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.