Executive brief
Twig, a popular template engine for PHP used to generate web pages, contains a vulnerability that allows for arbitrary code execution. An attacker who can provide or influence template content can bypass security restrictions to run unauthorized commands on the underlying server. This could lead to a complete system takeover, data theft, or service disruption.
Technical details
A code injection vulnerability exists in Twig's DotExpressionParser when handling dynamic attribute syntax. When the receiver is '_self' or an imported alias and the parenthesized expression is a string literal, the parser fails to validate the identifier before concatenating it into a MacroReferenceExpression. This results in raw, attacker-controlled strings being emitted directly into the generated PHP template source. Because this occurs during the compilation phase, the injected code executes at template-load time, bypassing the SandboxExtension and any SecurityPolicy allowlists. The issue is fixed in version 3.26.0 by adding identifier validation and proper escaping in the macro-reference compiler.
Affected products
- twigphp Twig >= 3.15.0, < 3.26.0
Timeline
- 2026-05-20: patched: Version 3.26.0 released
- 2026-05-20: advisory: GitHub Security Advisory GHSA-45vw-wh46-2vx8 published
- 2026-07-14: disclosed: CVE-2026-46640 published to NVD