CVE-2026-46633

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-46633
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46633.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-46633
Aliases
Downstream
CGA (2)
CLSA (4)
DEBIAN (1)
MINI (1)
ROOT (1)
UBUNTU (1)
Published
2026-07-14T21:14:24Z
Modified
2026-11-11T10:47:30Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Twig: PHP code injection via `{% use %}` template name
Details

Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46633.json"
}
References

Affected packages

Git / github.com/twigphp/twig

Affected ranges

Type
GIT
Repo
https://github.com/twigphp/twig
Events
Introduced
1fb5784662f438d7d96a541e305e28b812e2eeed
Fixed
1fcae487b180d78e6351f4e0afa91f9eab96a2bc
Fixed
679447fa29083043665482ccf7d64372472621b8
Fixed
a2c6db7ea7d2c90923e6708019ec1442526d1c30
Fixed
e9ff55f6910832428e48a35b2e0748189ad49ae3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "1.15.1"
                },
                {
                    "fixed": "3.26.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "679447fa29083043665482ccf7d64372472621b8"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "a2c6db7ea7d2c90923e6708019ec1442526d1c30"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "e9ff55f6910832428e48a35b2e0748189ad49ae3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v3.26.0",
            "range": [
                {
                    "fixed": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.15.1
v1.16.0
v1.16.1
v1.16.2
v1.16.3
v1.17.0
v1.18.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.3.1
v2.3.2
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.5.0
v2.6.0
v2.6.1
v2.6.2
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.7.4
v2.8.0
v2.8.1
v3.*
v3.0.0
v3.0.0-BETA1
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.1.0
v3.1.1
v3.10.0
v3.10.1
v3.10.2
v3.10.3
v3.11.0
v3.12.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.17.1
v3.18.0
v3.19.0
v3.2.1
v3.20.0
v3.21.0
v3.21.1
v3.22.0
v3.22.1
v3.22.2
v3.23.0
v3.24.0
v3.25.0
v3.3.0
v3.3.1
v3.3.10
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.3.6
v3.3.7
v3.3.8
v3.3.9
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.7.0
v3.7.1
v3.8.0
v3.9.0
v3.9.1
v3.9.2
v3.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46633.json"