Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. The result is that raw PHP code is injected into the generated template source and executed when the template is rendered, giving the attacker full code execution on the host. This is a code-injection flaw (CWE-94). Attackers could use this to exfiltrate data, deface the application, or launch further internal attacks. The issue is fixed in Twig 3.26.0.

Twig, the widely used PHP templating engine, is affected. Any installation using a non-patched version between 3.15.0 and 3.26.0 is vulnerable. The CNA identified Twig as the affected product, and no other vendors are listed.

The base CVSS score of 8.7 signals a high-severity flaw, yet the EPSS score of less than 1 % indicates a low global exploitation probability as of now. The vulnerability is not yet catalogued in CISA KEV. Attackers can exploit this by supplying a malicious template containing a crafted _self.(…) macro reference, so the attack vector is the template rendering path. Successful exploitation requires that the application load user-controlled template content or otherwise allow arbitrary template injection.