CVE-2026-46634: Twig sandbox bypass via template_from_string in SourcePolicyInterface

CVE-2026-46634 · Severity: medium · CVSS 0 · Published 2026-07-14

Twig is a popular template engine for PHP used to generate dynamic web content. A security flaw exists where the 'sandbox' mode, designed to safely run untrusted code, can be bypassed if certain functions are enabled. An attacker with the ability to edit or provide templates could exploit this to bypass security restrictions, potentially leading to the theft of sensitive data or full control over the web server.

Technologies: twig/twig (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46634 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46634 being exploited in the wild.
How severe is CVE-2026-46634?
Medium severity, with a CVSS score of 0, published 14 July 2026.
Which products and versions are affected?
twig/twig (Packagist) >= 3.9.0, < 3.26.0, ECOSYSTEM:introduced=3.9.0,fixed=3.26.0.
Is there a fix for CVE-2026-46634?
Yes. twig/twig (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46634 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46634?
Check whether you run twig/twig (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/twig (Packagist): upgrade to 3.26.0 or later
    composer require twig/twig:^3.26.0

Technical details

A vulnerability in Twig's sandboxing mechanism occurs when the sandbox is enabled selectively via SourcePolicyInterface. When a sandboxed template calls template_from_string(), Twig compiles the new inner template using a synthesized name (e.g., __string_template__<hash>). Because this name does not match existing name-based or path-based security policies, the SourcePolicy returns false, causing the inner template's security checks to be bypassed. An attacker can leverage this to execute restricted functions, such as using the 'constant' function to read secrets or the 'map' filter with 'system' to achieve remote code execution. The issue is addressed in version 3.26.0 through updated documentation and warnings, as the vendor considers this a configuration trap; integrators are advised to never allow template_from_string in sandboxed environments.

Affected products

  • twigphp Twig >= 3.9.0, < 3.26.0

Identifiers

  • CVE-2026-46634
  • GHSA-24x9-r6q4-q93w

Timeline

  • 2026-05-20: patched: Version 3.26.0 released
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-24x9-r6q4-q93w published
  • 2026-07-14: disclosed: CVE-2026-46634 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.