Vulnerability Description
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Symfony | Twig | >= 3.15.0, < 3.26.0 |
Related Weaknesses (CWE)
References
- https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2Patch
- https://github.com/twigphp/Twig/releases/tag/v3.26.0Release Notes
- https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8Vendor Advisory
FAQ
What is CVE-2026-46640?
CVE-2026-46640 is a vulnerability with a CVSS score of 8.8 (HIGH). Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression ...
How severe is CVE-2026-46640?
CVE-2026-46640 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-46640?
Check the references section above for vendor advisories and patch information. Affected products include: Symfony Twig.