CVE-2026-46635 — MEDIUM (4.3)

Q: How severe is CVE-2026-46635?

CVE-2026-46635 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-46635?

Check the references section above for vendor advisories and patch information. Affected products include: Symfony Twig.

Vulnerability Description

Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Symfony	Twig	< 3.26.0

Related Weaknesses (CWE)

CWE-863

References

FAQ

What is CVE-2026-46635?

CVE-2026-46635 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute...

How severe is CVE-2026-46635?

CVE-2026-46635 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-46635?

Check the references section above for vendor advisories and patch information. Affected products include: Symfony Twig.