Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-46638Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Medium 6.0

In plain English

A medium-severity security flaw in Twig from twigphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.0Medium

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-twig	no fix listed	DEBIAN-CVE-2026-46638
Debian:13	php-twig	3.27.0-0+deb13u1	DEBIAN-CVE-2026-46638
Debian:14	php-twig	3.26.0-1	DEBIAN-CVE-2026-46638
Packagist	twig/twig	3.26.0	GHSA-7fxw-r6jv-74c8
Ubuntu:25.10	php-twig	no fix listed	UBUNTU-CVE-2026-46638
Ubuntu:26.10	php-twig	no fix listed	UBUNTU-CVE-2026-46638

Affected products (as reported)

Vendor	Product	Versions
twigphp	Twig	< 3.26.0

Weakness: CWE-693 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/twigphp/Twig/security/advisories/GHSA-7fxw-r6jv-74c8 x_refsource_CONFIRM
https://github.com/twigphp/Twig/commit/819c6a89fe0f261b8555c4f4d5e27d31984223ea x_refsource_MISC
https://github.com/twigphp/Twig/releases/tag/v3.26.0 x_refsource_MISC