Which versions of Twig are affected by CVE-2026-46639?

Twig versions 3.24.0 through 3.25.x contain a sandbox escape vulnerability allowing template writers to access arbitrary object properties and methods; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-46639?

24 hours: Identify systems running Twig 3.24.0-3.25.x; audit who has template write access and what objects are exposed to templates. 7 days: Restrict template authorship to internal developers; remove non-essential objects from template context. 30 days: Monitor Twig release notes for version 3.26.0 or later containing the patch; upgrade immediately upon release.

Twig CVE-2026-46639

Q: What is the CVSS score of CVE-2026-46639?

CVE-2026-46639 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Protection Mechanism Failure (CWE-693)

2026-05-21 https://github.com/twigphp/Twig

GHSA-mm6w-gr99-p3jj

PHP Authentication Bypass

7.1

CVSS 4.0 · Vendor: https://github.com/twigphp/Twig

Severity by source

Vendor (https://github.com/twigphp/Twig) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/twigphp/Twig) · only source for this CVE.

CVSS VectorVendor: https://github.com/twigphp/Twig

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jul 14, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 22:22 NVD

7.1 (HIGH)

Source Code Evidence Fetched

May 21, 2026 - 22:33 vuln.today

Analysis Generated

May 21, 2026 - 22:33 vuln.today

DescriptionCVE.org

Description

The object-destructuring assignment syntax introduced in Twig 3.24.0 generates a call to CoreExtension::getAttribute() with the $sandboxed argument hardcoded to false, regardless of whether a SandboxExtension is active. This permanently disables the sandbox's property and method policy checks for every destructuring expression.

ObjectDestructuringSetBinary::compile() emits:

php

CoreExtension::getAttribute($this->env, $this->source, ..., \Twig\Template::ANY_CALL, false, false, false, ...);
//                                                                                ^^^^^
//                                                                       sandbox check never runs

Whereas GetAttrExpression::compile() correctly passes $env->hasExtension(SandboxExtension::class).

An attacker with write access to a sandboxed Twig template can read any public property or invoke any public getter on objects passed to the template engine, bypassing SecurityPolicy restrictions. The exploit requires only the {% do %} tag to be in allowedTags, which is a common configuration.

Resolution

The destructuring compiler now forwards the active sandbox flag to getAttribute() so property/method allowlists are enforced.

Credits

Twig would like to thank Anvil Secure in collaboration with Claude and Anthropic Research for reporting and fixing the issue.

AnalysisAI

Sandbox escape in Twig 3.24.0 through 3.25.x lets an attacker with write access to a sandboxed template read arbitrary public properties and invoke any public getter on objects exposed to the template, bypassing the SandboxExtension's SecurityPolicy allowlists. The flaw exists because the object-destructuring compiler hardcodes the $sandboxed flag to false when emitting CoreExtension::getAttribute() calls, so policy checks never run for destructuring expressions whenever the {% do %} tag is permitted. No public exploit identified at time of analysis, but the issue was responsibly disclosed with vendor-confirmed root cause and an upstream patch.

Technical ContextAI

Twig is the PHP templating engine maintained by Symfony/SensioLabs and embedded in CMSes and frameworks (Drupal, Symfony, Craft CMS, eZ Platform, Shopware, Grav, etc.) where untrusted users can submit templates protected by SandboxExtension. The sandbox relies on SecurityPolicy allowlists enforced at runtime by CoreExtension::getAttribute(), which only checks allowlists when its $sandboxed argument is true. Twig 3.24.0 introduced object-destructuring assignment, whose compiler ObjectDestructuringSetBinary::compile() emits getAttribute() calls with $sandboxed hardcoded to false rather than the correct $env->hasExtension(SandboxExtension::class) check used by GetAttrExpression::compile(). The CWE-693 (Protection Mechanism Failure) classification captures the root cause: an existing security control silently does not run on a new code path.

RemediationAI

Vendor-released patch: upgrade twig/twig to 3.26.0 or later via Composer (composer require twig/twig:^3.26 or composer update twig/twig), which forwards the active sandbox flag from the destructuring compiler to CoreExtension::getAttribute() so allowlists are enforced. Advisory details are at https://github.com/twigphp/Twig/security/advisories/GHSA-mm6w-gr99-p3jj and https://symfony.com/cve-2026-46639. If immediate upgrade is not possible, remove the {% do %} tag from SandboxExtension's allowedTags (this blocks the exploit path but breaks any legitimate templates relying on {% do %}), or disable user-submitted template authoring entirely until the package is updated; additionally, audit which objects are passed into sandboxed templates and remove any exposing sensitive properties or getters as a hardening step.