Code Injection Flaw in Twig Template Language Affecting PHP Applications

CVE-2026-46633

What is CVE-2026-46633?

An issue has been identified in Twig, a popular PHP template language, where the Compiler::string() method fails to escape single quotes when a template name from a {% use %} tag is embedded within a PHP single-quoted string literal. This oversight allows an attacker to craft a malicious template name that can terminate the string, potentially leading to the injection of arbitrary PHP expressions into the compiled cache file. The vulnerability was addressed in version 3.26.0 of Twig.

References