Log in Start free

Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M

CVE-2026-46636Twig: Sandbox method allowlist bypass via `Markup` subclass

High 8.7

In plain English

A high-severity security flaw in Twig from twigphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 52.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12php-twigno fix listedDEBIAN-CVE-2026-46636
Debian:13php-twig3.27.0-0+deb13u1DEBIAN-CVE-2026-46636
Debian:14php-twig3.27.0-1DEBIAN-CVE-2026-46636
Ubuntu:25.10php-twigno fix listedUBUNTU-CVE-2026-46636
Ubuntu:26.10php-twigno fix listedUBUNTU-CVE-2026-46636

Affected products (as reported)

VendorProductVersions
twigphp Twig >= 1.0.0, < 3.27.0

Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References