CVE-2026-46634
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in the Twig template library for PHP (versions 3.9.0 through 3.26.0) allows bypassing the SourcePolicyInterface sandbox security policy when rendering templates via the template_from_string() function. The inner template is compiled under a synthetic name that can fall outside the sandbox decision, enabling an attacker to execute code without security policy enforcement.
Risk Assessment
The organization is at risk of unauthorized code execution within the PHP application context, potentially leading to data leakage, privilege escalation, or server compromise.
Recommendation
Immediately update the Twig library to version 3.26.0 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.