PT-2026-42173 · Twig · Twig

Published 2026-05-20 · Updated 2026-06-07 · CVE-2026-46633

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description The Compiler::string() function fails to escape single quotes when generating PHP double-quoted string literals. In ModuleNode::compileConstructor(), template names from a {% use %} tag are processed via subcompile() and string(), then placed within a PHP single-quoted string literal. A template name containing a single quote can terminate the string prematurely, allowing the injection of arbitrary PHP expressions into the compiled cache file. This leads to remote code execution within the PHP process when the cache file is loaded, bypassing the Twig sandbox because SecurityPolicy allows the {% use %} tag regardless of the allowedTags configuration.

Recommendations Update to the version where Compiler::string() escapes single quotes to prevent template names from breaking out of the surrounding PHP literals.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-46633

GHSA-7P85-W9PX-JPJP

Affected Products

Twig

References · 17

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46633.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-46633 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46633 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-46633 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-46633 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-46633 · Vendor Advisory
• https://github.com/twigphp/Twig · Note
• https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp · Note
• https://gist.github.com/vladko312/39507beaa58eacf3b62e6a6e6cd69128 · Reddit Post
• https://twitter.com/symfony/status/2057046396528677145 · Twitter Post
• https://symfony.com/cve-2026-46633 · Note
• https://twitter.com/vladko312/status/2063732479442530751 · Twitter Post
• https://twitter.com/UpwindMDR/status/2057737303238332438 · Twitter Post
• https://symfony.com/blog/cve-2026-46633-php-code-injection-via-use-template-name · Note