PT-2026-42174 · Twig · Twig
Published
2026-05-20
·
Updated
2026-05-21
·
CVE-2026-46634
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Twig versions prior to 3.26.0
Description
When a sandbox is enabled selectively via
SourcePolicyInterface rather than globally, a sandboxed template permitted to use template from string and include can render an arbitrary inner template without security policy enforcement. This occurs because Environment::createTemplate() compiles the inner string using a synthesized name ( string template <hash>), causing a name or path-based SourcePolicy to return false and rendering the inner template's checkSecurity() function ineffective. An attacker can then utilize any tag, filter, or function, such as constant() to access secrets or |map("system") to execute shell commands.Recommendations
Update to version 3.26.0 or later.
Do not allow
template from string in the SecurityPolicy allowed-functions list when using a SourcePolicyInterface.
As a mitigation measure, avoid registering StringLoaderExtension when a sandbox is in use.Exploit
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Twig