CVE-2026-46633 is a critical code injection flaw in Twig, the PHP template language, scored CVSS 9.8. A crafted template name in a use tag can inject PHP into the compiled cache file. Twig 3.26.0 fixes it, so upgrade the twig/twig package to that version or later.
What's affected
The GitHub advisory GHSA-7p85-w9px-jpjp says Twig versions before 3.26.0 are affected, and that 3.26.0 is the patched release. The advisory does not list other branches, so I cannot confirm whether older release lines got a backport. Check the advisory if you run an older line.
Twig is pulled in by Symfony and many PHP frameworks and CMS products, so you may run it without having chosen it.
How to check if you're exposed
- In a Composer project, run
composer show twig/twigand read the version. - To see why it is installed, run
composer why twig/twig. - Check every PHP application on the host, including CMS plugins that vendor their own copy under a vendor directory.
- Ask whether any code builds Twig template names from user input or stored data. The advisory says the problem is in how a name from a use tag is written into the compiled cache file.
Version 3.26.0 or later is the fixed state.
What to do now
- Run
composer update twig/twigand confirm the lock file shows 3.26.0 or later. - Clear the compiled template cache so old generated files are rebuilt after the upgrade.
- Make sure the cache directory is writable only by the application user.
- Never let untrusted users supply template names or template source.
- Rebuild and redeploy containers that bake in vendor directories.
The advisory lists no workaround, so the upgrade is the fix.
Why it matters
The weakness is CWE-94, improper control of code generation. Twig compiles templates into PHP. The advisory says the string escaping helper handled double quotes but not single quotes, while the template name was placed inside a single quoted PHP string. A name with a single quote could end the string early and add PHP code, which runs when the cache file is first loaded.
The advisory also notes the security policy always allows the use tag, so sandboxed templates can reach this path. The KEV flag is false and no exploitation is reported.
Quick check
Does the Twig sandbox protect me?
The advisory says sandboxed templates can reach the affected code because the policy always allows the use tag. Upgrade rather than relying on the sandbox.
Sources
Last reviewed: 19 October 2026.
