CVE-2026-46633

Published: Jul 14, 2026Modified: Jul 16, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

Affected (1)

Products: Symfony: Twig

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Symfony Twig	Before 3.26.0

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8

Source: security-advisories@github.com

Patch

https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3

Source: security-advisories@github.com

Patch

https://github.com/twigphp/Twig/releases/tag/v3.26.0

Source: security-advisories@github.com

Release Notes

https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.