Executive brief
Twig is a popular template engine for PHP used to generate dynamic web content. A vulnerability in how it handles template names allows an attacker to inject and execute malicious PHP code on the server. This bypasses security restrictions (sandboxing) and could lead to full system compromise or unauthorized data access.
Technical details
A code injection vulnerability exists in Twig's Compiler::string() method, which fails to escape single quotes when generating PHP code. When a template name from a '{% use %}' tag is processed in ModuleNode::compileConstructor(), it is placed inside a single-quoted PHP string literal in the compiled cache file. An attacker can provide a template name containing a single quote to terminate the string literal and inject arbitrary PHP expressions. Because the SecurityPolicy unconditionally allows the '{% use %}' tag, this vulnerability can be exploited even from within a sandboxed environment to achieve remote code execution (RCE). The issue is resolved in version 3.26.0 by ensuring single quotes are escaped as hex sequences.
Affected products
- twigphp Twig < 3.26.0
Timeline
- 2026-05-20: patched: Version 3.26.0 released
- 2026-05-20: advisory: GitHub Security Advisory GHSA-7p85-w9px-jpjp published
- 2026-07-14: disclosed: CVE-2026-46633 published to NVD