Description
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
Published: 2026-07-14
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This bypasses the sandbox restrictions, and the issue is fixed by upgrading to version 3.26.0. The weakness is classified as CWE‑693.

Affected Systems

The vendor/product is Twig from twigphp. Affected versions are all releases from 3.9.0 up through 3.26.0, inclusive. These versions expose the sandbox escape via template_from_string.

Risk and Exploitability

The CVSS score is 7.7, indicating a high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires the ability to supply or influence the template content, after which the attacker can trigger template_from_string to render an inner template outside the defined policy.

Generated by OpenCVE AI on July 31, 2026 at 04:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Twig to version 3.26.0 or later to apply the patch that removes the legacy template_from_string behavior.
  • Verify that the application does not create templates from untrusted input or call template_from_string from within sandboxed templates; refactor code to avoid dynamic template compilation.
  • If an upgrade cannot be performed immediately, enforce a strict whitelist of allowed template names and disable the inclusion of dynamically generated templates, or remove the sandbox policy for known safe templates.

Generated by OpenCVE AI on July 31, 2026 at 04:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6311-1 php-twig security update
Github GHSA Github GHSA GHSA-24x9-r6q4-q93w Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
History

Wed, 29 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Twigphp
Twigphp twig
Vendors & Products Twigphp
Twigphp twig

Tue, 14 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
Title Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
Weaknesses CWE-693
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Twigphp Twig
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-29T18:26:17.523Z

Reserved: 2026-05-15T20:11:54.583Z

Link: CVE-2026-46634

cve-icon Vulnrichment

Updated: 2026-07-29T18:24:03.183Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:45:17Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure