Which versions of Twig are affected by CVE-2026-46640?

Twig templating engine versions 3.15.0 through 3.25.x contain a critical vulnerability enabling arbitrary PHP code execution that completely bypasses the intended SandboxExtension security control.. A patch is available.

How to fix or mitigate CVE-2026-46640?

Within 24 hours: Identify all systems running Twig 3.15.0-3.25.x and assess which handle untrusted template input. Within 7 days: Implement compensating controls including strict access controls on template sources, disable dynamic template processing features, and apply network isolation for high-risk applications. Within 30 days: Monitor the Twig project for security patch release and prepare tested upgrade strategy to pre-3.15.0 versions or patched 3.26.0+ release.

Twig CVE-2026-46640

Q: What is the CVSS score of CVE-2026-46640?

CVE-2026-46640 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Code Injection (CWE-94)

2026-05-21 https://github.com/twigphp/Twig

GHSA-45vw-wh46-2vx8

PHP Code Injection RCE

8.7

CVSS 4.0 · Vendor: https://github.com/twigphp/Twig

Severity by source

Vendor (https://github.com/twigphp/Twig) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/twigphp/Twig) · only source for this CVE.

CVSS VectorVendor: https://github.com/twigphp/Twig

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jul 14, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 22:22 NVD

8.7 (HIGH)

Source Code Evidence Fetched

May 21, 2026 - 22:33 vuln.today

Analysis Generated

May 21, 2026 - 22:33 vuln.today

DescriptionCVE.org

Description

The obj.(expr) dynamic-attribute syntax (added in 3.15.0 as the replacement for the deprecated attribute() function) lets the attribute be an arbitrary expression. When the receiver is _self (or any {% import %} alias) and the parenthesised expression is a string literal, DotExpressionParser short-circuits to the macro-call path and concatenates the attacker-controlled string into a MacroReferenceExpression name with no identifier validation. MacroReferenceExpression::compile() then emits that name raw into the generated PHP source.

An attacker who can supply template source can inject arbitrary PHP into the compiled template and execute it at template-load time, before checkSecurity() is ever called. This is a complete bypass of SandboxExtension, including a globally-enabled sandbox with an empty SecurityPolicy allowlist.

Resolution

The parser now validates that the dynamic attribute resolves to a valid macro identifier before routing through MacroReferenceExpression, and the macro-reference compiler emits the name through a properly escaped path.

Credits

Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

AnalysisAI

Arbitrary PHP code execution in Twig templating engine versions 3.15.0 through 3.25.x allows attackers who control template source to inject raw PHP into the compiled template via the _self.(<string>) dynamic-attribute macro-reference path, fully bypassing the SandboxExtension. The flaw executes injected code at template-load time, before any SecurityPolicy check runs, rendering even a globally-enabled empty allowlist sandbox ineffective. No public exploit identified at time of analysis, but the vendor advisory describes the bypass mechanism in enough detail that PoC development is straightforward.

Technical ContextAI

Twig is the most widely deployed PHP templating engine, embedded in Symfony, Drupal, Shopware, Ibexa, and thousands of CMS/SaaS stacks via the composer/twig/twig package. The vulnerability lives in DotExpressionParser handling of the obj.(expr) dynamic-attribute syntax introduced in 3.15.0 to replace the deprecated attribute() function. When the receiver is _self or an {% import %} alias and the parenthesised expression is a string literal, the parser shortcuts into the macro-call path and concatenates the attacker-supplied string into a MacroReferenceExpression name without identifier validation. MacroReferenceExpression::compile() then emits that string raw into the generated PHP source file Twig writes to its cache, so when PHP includes the compiled template the attacker's code runs natively. This is a classic CWE-94 Improper Control of Generation of Code (code injection) caused by failure to validate/escape an identifier before string-interpolating it into emitted source.

RemediationAI

Vendor-released patch: upgrade twig/twig to 3.26.0, which validates that the dynamic attribute resolves to a valid macro identifier before routing through MacroReferenceExpression and emits the macro name through a properly escaped compile path. Update via composer update twig/twig and verify the resolved version is >= 3.26.0; downstream framework users should also pick up the matching Symfony/Drupal/Shopware security release referenced at https://symfony.com/cve-2026-46640 and https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8. If patching is blocked, the only effective compensating control is to ensure no untrusted party can supply or influence Twig template source - disable any user-facing template editors, do not pass user input into Twig\Environment::createTemplate() or string loaders, and audit any custom loader that reads templates from databases or uploads; note that relying on SandboxExtension with a restrictive SecurityPolicy is NOT a valid workaround because this vulnerability executes before checkSecurity() is called. A more invasive workaround is to lint/strip incoming templates for the _self.(...) and <alias>.(...) patterns (with the alias being any {% import %} name), which can break legitimate macro usage in tenants that rely on dynamic macro dispatch.