CVE-2026-46633 — Vulnerability intelligence

symfony — twig

Published: 2026-07-14T21:14:24.916Z

CVSS

8.7

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

Sources

• CVE-2026-46633
• Patch
• Patch
• Release Notes
• Vendor Advisory
• CVE-2026-46633
• Original advisory
• Original advisory
• Original advisory
• Original advisory