CVE-2026-46640: Twig PHP code injection in macro-reference compilation

CVE-2026-46640 · Severity: high · CVSS 4 · Published 2026-07-14

Twig, a popular template engine for PHP used to generate web pages, contains a vulnerability that allows for arbitrary code execution. An attacker who can provide or influence template content can bypass security restrictions to run unauthorized commands on the underlying server. This could lead to a complete system takeover, data theft, or service disruption.

Technologies: twig/twig (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46640 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46640 being exploited in the wild.
How severe is CVE-2026-46640?
High severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
twig/twig (Packagist) >= 3.15.0, < 3.26.0, ECOSYSTEM:introduced=3.15.0,fixed=3.26.0.
Is there a fix for CVE-2026-46640?
Yes. twig/twig (Packagist): upgrade to 3.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46640 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-46640?
Check whether you run twig/twig (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • twig/twig (Packagist): upgrade to 3.26.0 or later
    composer require twig/twig:^3.26.0

Technical details

A code injection vulnerability exists in Twig's DotExpressionParser when handling dynamic attribute syntax. When the receiver is '_self' or an imported alias and the parenthesized expression is a string literal, the parser fails to validate the identifier before concatenating it into a MacroReferenceExpression. This results in raw, attacker-controlled strings being emitted directly into the generated PHP template source. Because this occurs during the compilation phase, the injected code executes at template-load time, bypassing the SandboxExtension and any SecurityPolicy allowlists. The issue is fixed in version 3.26.0 by adding identifier validation and proper escaping in the macro-reference compiler.

Affected products

  • twigphp Twig >= 3.15.0, < 3.26.0

Identifiers

  • CVE-2026-46640
  • GHSA-45vw-wh46-2vx8

Timeline

  • 2026-05-20: patched: Version 3.26.0 released
  • 2026-05-20: advisory: GitHub Security Advisory GHSA-45vw-wh46-2vx8 published
  • 2026-07-14: disclosed: CVE-2026-46640 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.