Technical impact
Twig, the popular PHP template engine, contains a flaw in its Compiler::string() method. From version 1.15.1 through all releases prior to 3.26.0, this method fails to escape single quotes when a template name supplied by a {% use %} tag is embedded inside a PHP single‑quoted string literal. An attacker who can control that template name can terminate the string and inject arbitrary PHP expressions into the compiled cache file. The resulting code‑injection vulnerability, classified as CWE‑94, permits an attacker to execute arbitrary PHP code with the privileges of the web server or PHP process.
Affected Systems
Twig template engine, developed by twigphp:Twig, is affected. All versions preceding 3.26.0 are vulnerable, including Twig 3.x releases. The vulnerability is fixed in Twig 3.26.0 and later releases. Applications that embed Twig and allow user‑controlled template names via {% use %} are directly impacted.
Risk and Exploitability
Security assessment of this issue yields a CVSS score of 8.7 and an EPSS probability of less than 1 %, indicating that while the flaw is severe, actual exploitation is currently rare. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to supply a malicious template name to the {% use %} tag, which typically implies that the attacker can influence template rendering or upload a template. The attack surface is therefore limited to applications that expose dynamic template names or allow arbitrary user input to be interpreted as a template name. Once an attacker succeeds, they can execute arbitrary PHP code with the permissions of the web server or PHP process, posing a critical threat to application integrity.
Debian DSA
Github GHSA