Live › vulnerability › CVE-2026-46633
Twig's compiler fails to escape single quotes in template names used by the {% use %} tag, so a crafted name breaks out of a generated PHP string. The injected PHP runs when the compiled cache file is first loaded, which lets an attacker run code on the server even inside Twig's sandbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:01 UTC, 0h before NVD. All times on this page are UTC.
Applications that use the Twig PHP template engine at versions from 1.15.1 up to 3.26.0 are exposed. The risk is highest where template names can come from untrusted input, including sandboxed templates, since the sandbox does not block {% use %}. Projects that only render fixed templates they wrote themselves are less exposed but should still upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| twig/twig | composer | >= 1.15.1, < 3.26.0 | 3.26.0 |
| symfony twig | vendor | < 3.26.0 | 3.26.0 |
composer show twig/twig and look at the version line.twig/twig and note the version.1.15.13.26.0twig/twig to 3.26.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Compiler::string() escapes ", $, \, NUL and TAB when generating PHP double-quoted string literals, but does not escape single quotes. In ModuleNode::compileConstructor(), the template name from a {% use %} tag is compiled via subcompile() -> string() and placed inside a surrounding PHP single-quoted string literal. A template name containing a single quote terminates that surrounding string early, allowing arbitrary PHP expressions to be injected into the compiled cache file.
The injected code executes within the PHP process when the cache file is first loaded, bypassing the Twig sandbox entirely and achieving remote code execution. SecurityPolicy unconditionally allows {% use %} regardless of the configured allowedTags, so this primitive is reachable from sandboxed templates as well.
Compiler::string() now also escapes single quotes so that template names placed inside single-quoted PHP literals can no longer break out of the surrounding context.
Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting the issue and providing the fix.
This page as .md · .json · in your agent: get_signal("CVE-2026-46633")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.