CVE-2026-46638: Twig sandbox bypass in cached template inclusion

CVE-2026-46638 · Severity: medium · CVSS 4 · Published 2026-07-14

Twig, a popular template engine for PHP applications, contains a security flaw in its sandbox mode. This mode is typically used to safely run untrusted code, such as user-submitted templates, by restricting access to sensitive functions. An attacker could bypass these restrictions to execute unauthorized functions or filters, potentially leading to data exposure or unauthorized actions within the application.

Technologies: twig/twig (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46638 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46638 being exploited in the wild.
How severe is CVE-2026-46638?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
twig/twig (Packagist) < 3.26.0, ECOSYSTEM:introduced=0,fixed=3.26.0.
Is there a fix for CVE-2026-46638?
Yes. twig/twig (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46638 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46638?
Check whether you run twig/twig (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/twig (Packagist): upgrade to 3.26.0 or later
    composer require twig/twig:^3.26.0

Technical details

A vulnerability in Twig's sandbox implementation allows a bypass of SecurityPolicy::checkSecurity() when using the {% sandbox %}{% include %} tag sequence. The issue occurs because templates previously loaded outside of a sandboxed environment are cached in Environment::$loadedTemplates. When these cached templates are subsequently included within a sandbox tag, the engine fails to re-invoke security checks, relying on the initial (non-sandboxed) security state. This allows an attacker who can author or influence the included template to execute tags, filters, and functions that should be restricted by the sandbox policy. This is an incomplete fix for a previous vulnerability (CVE-2024-45411) and is resolved in version 3.26.0.

Affected products

  • twigphp Twig < 3.26.0

Identifiers

  • CVE-2026-46638
  • GHSA-7fxw-r6jv-74c8

Timeline

  • 2026-05-20: patched: Version 3.26.0 released
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-7fxw-r6jv-74c8 published
  • 2026-07-14: disclosed: CVE-2026-46638 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.