Twig's Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single‑quoted string literal. This allows a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. The flaw is fixed in version 3.26.0, but versions prior to that remain vulnerable. An attacker who can influence the template name can inject and execute arbitrary PHP code in the application, constituting a code‑injection vulnerability identified as CWE‑94 that can result in remote code execution depending on the PHP process privileges.

Twig template engine, developed by twigphp:Twig, is affected. All versions preceding 3.26.0 are vulnerable, including Twig 3.x releases. The vulnerability is fixed in Twig 3.26.0 and later releases. Applications that embed Twig and allow user‑controlled template names via {% use %} are directly impacted.

Security assessment of this issue yields a CVSS score of 8.7 and an EPSS probability of less than 1 %, indicating that while the flaw is severe, actual exploitation is currently rare. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires an attacker to supply a malicious template name to the {% use %} tag, which typically implies that the attacker can influence template rendering or upload a template. The attack surface is therefore limited to applications that expose dynamic template names or allow arbitrary user input to be interpreted as a template name. Once an attacker succeeds, they can execute arbitrary PHP code with the permissions of the web server or PHP process, posing a critical threat to application integrity.