CVE-2026-46636: twigphp twig

Vulnerability summary

CVE-2026-46636 is a high (CVSS 8.7) vulnerability in twigphp twig. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities.

Timeline

1. 04-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.

• CWE-1336Improper Neutralization of Special Elements Used in a Template EngineThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.