CVE-2026-46638
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
CVE-2026-46638- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693
- Updated
- 2026-11-02
EUVDEUVD-2026-44570
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
EUVD-2026-44570- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7fxw-r6jv-74c8
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Description
The fix for CVE-2024-45411 / GHSA-6j75-5wfj-gh66 added an explicit $loaded->unwrap()->checkSecurity() call in CoreExtension::include() so that a template already cached in Environment::$loadedTemplates is re-checked when included with sandboxed = true.
The deprecated but still functional {% sandbox %}{% include ... %}{% endsandbox %} tag path was not updated: it compiles to enableSandbox(); yield from $this->load(...)->unwrap()->yield(...); disableSandbox(); with no checkSecurity() re-invocation. If the included template was loaded once outside the sandbox in the same Environment instance, its constructor (and therefore its compiled checkSecurity() call) already ran while isSandboxed() was false, so the tags/filters/functions allowlist enforced by SecurityPolicy::checkSecurity() is never applied.
An attacker who can author the included template gains access to every filter, function and tag registered in the environment, regardless of the sandbox policy.
Resolution
The compiled output of {% sandbox %}{% include %} now calls checkSecurity() on the loaded template, matching the behaviour of CoreExtension::include() with sandboxed = true.
Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-7fxw-r6jv-74c8- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H - Weakness
- CWE-693
- Updated
- 2026-11-02
NVD
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
CVE-2026-46638- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSV
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
CVE-2026-46638- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-46638
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
DEBIAN-CVE-2026-46638- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-7fxw-r6jv-74c8
Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)
Description
The fix for CVE-2024-45411 / GHSA-6j75-5wfj-gh66 added an explicit $loaded->unwrap()->checkSecurity() call in CoreExtension::include() so that a template already cached in Environment::$loadedTemplates is re-checked when included with sandboxed = true.
The deprecated but still functional {% sandbox %}{% include ... %}{% endsandbox %} tag path was not updated: it compiles to enableSandbox(); yield from $this->load(...)->unwrap()->yield(...); disableSandbox(); with no checkSecurity() re-invocation. If the included template was loaded once outside the sandbox in the same Environment instance, its constructor (and therefore its compiled checkSecurity() call) already ran while isSandboxed() was false, so the tags/filters/functions allowlist enforced by SecurityPolicy::checkSecurity() is never applied.
An attacker who can author the included template gains access to every filter, function and tag registered in the environment, regardless of the sandbox policy.
Resolution
The compiled output of {% sandbox %}{% include %} now calls checkSecurity() on the loaded template, matching the behaviour of CoreExtension::include() with sandboxed = true.
Credits
Twig would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Record
GHSA-7fxw-r6jv-74c8- CVSS 4.0
- 5.8 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H - Weakness
- CWE-693
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-46638
Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.
- Record
UBUNTU-CVE-2026-46638- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1783991054 No score
TuxCare security update for twig/twig (11 CVEs)
TuxCare rebuilt twig/twig to address 11 CVEs. Fixed in v2.16.1-p1+tuxcare.
- Record
CLSA-2026-1783991054- Updated
- 2026-11-02
OSVCLSA-2026-1784682913 No score
TuxCare security update for twig/twig (10 CVEs)
TuxCare rebuilt twig/twig to address 10 CVEs. Fixed in v2.15.6-p2+tuxcare.
- Record
CLSA-2026-1784682913- Updated
- 2026-11-02
OSVCLSA-2026-1786534048 No score
TuxCare security update for twig/twig (8 CVEs)
TuxCare rebuilt twig/twig to address 8 CVEs. Fixed in v1.44.8-p1+tuxcare.
- Record
CLSA-2026-1786534048- Updated
- 2026-11-02
OSVROOT-APP-COMPOSER-CVE-2026-46638 No score
CVE-2026-46638 in twig/twig - Patched by Root
Root has patched CVE-2026-46638 in the twig/twig package for Root:Composer. Multiple fixed versions available.
- Record
ROOT-APP-COMPOSER-CVE-2026-46638- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
twig/twigPackagist |
before 3.26.0 | 3.26.0 |
twig/twigTuxCare:Packagist From an advisory covering 11 CVEs |
v2.16.1 up to v2.16.1-p1+tuxcare | v2.16.1-p1+tuxcare |
twig/twigTuxCare:Packagist From an advisory covering 10 CVEs |
v2.15.6 up to v2.15.6-p2+tuxcare, plus listed versions v2.15.6-p1+tuxcare |
v2.15.6-p2+tuxcare |
twig/twigTuxCare:Packagist From an advisory covering 8 CVEs |
v1.44.8 up to v1.44.8-p1+tuxcare | v1.44.8-p1+tuxcare |
php-twigDebian:12 |
All versions, plus listed versions 3.10.1-13.10.3-13.11.0-13.13.0-13.14.0-1 Show 45 moreShow less3.14.0-23.14.0-33.14.0-43.14.2-13.14.2-23.14.2-33.15.0-13.15.0-23.17.1-13.17.1-23.18.0-13.18.0-23.18.0-43.18.0-53.18.0-63.18.0-73.19.0-13.19.0-1~bootstrap3.20.0-13.20.0-1~bootstrap3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-13.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-13.27.0-13.27.1-13.28.0-13.5.1-13.5.1-1+deb12u13.5.1-1+deb12u23.5.1-1+deb12u33.6.0-13.6.1-13.7.0-1 |
None known |
php-twigDebian:13 |
before 3.27.0-0+deb13u1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 11 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-13.26.0-0+deb13u13.26.0-1 |
3.27.0-0+deb13u1 |
php-twigDebian:14 |
before 3.26.0-1, plus listed versions 3.20.0-23.21.1-13.21.1-23.21.1-33.22.0-1 Show 9 moreShow less3.22.0-23.22.1-13.22.1-23.22.1-33.22.2-13.22.2-23.23.0-13.23.0-23.24.0-1 |
3.26.0-1 |
twig/twigPackagist |
before 3.26.0, plus listed versions 1.3.01.4.01.5.01.5.11.6.0 Show 45 moreShow less1.6.11.6.21.6.31.6.41.6.5v1.10.0v1.10.1v1.10.2v1.10.3v1.11.0v1.11.1v1.12.0v1.12.0-RC1v1.12.1v1.12.2v1.12.3v1.13.0v1.13.1v1.13.2v1.14.0v1.14.1v1.14.2v1.15.0v1.15.1v1.16.0v1.16.1v1.16.2v1.16.3v1.17.0v1.18.0v1.18.1v1.18.2v1.19.0v1.20.0v1.21.0v1.21.1v1.21.2v1.22.0v1.22.1v1.22.2v1.22.3v1.23.0v1.23.1v1.23.2v1.23.3 |
3.26.0 |
twig/twigRoot:Composer |
before v3.11.3-p12007003+root.io | v3.11.3-p12007003+root.iov3.11.3-p12007004+root.iov3.11.3-p12007005+root.io |
php-twigUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.11.3-22.12.1-12.12.2-12.12.3-12.12.5-12.12.5-1ubuntu0.1~esm12.12.5-1ubuntu0.1~esm2 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-twigUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.3.2-1ubuntu33.3.4-13.3.6-13.3.7-13.3.8-2ubuntu43.3.8-2ubuntu4+esm13.3.8-2ubuntu4+esm2 |
None known |
php-twigUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.7.0-13.7.1-13.8.0-23.8.0-2ubuntu0.1~esm13.8.0-2ubuntu13.8.0-2ubuntu1+esm1 |
None known |
php-twigUbuntu:25.10 |
All versions, plus listed versions 3.20.0-2ubuntu1 |
None known |
php-twigUbuntu:26.10 |
All versions, plus listed versions 3.23.0-2build73.27.1-13.28.0-1 |
None known |
php-twigUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 3.20.0-2ubuntu13.23.0-2build53.23.0-2build73.23.0-2ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-46638 is a medium vulnerability (CVSS 6.0) in Symfony Twig, published May 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in twig/twig 3.26.0.
References
github.com/twigphp/Twig/security/advisories/GHSA-7fxw-r6jv-74c8
symfony.com/cve-2026-46638
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-46638
security-tracker.debian.org/tracker/CVE-2026-46638
ubuntu.com/security/CVE-2026-46638
cve.org/CVERecord?id=CVE-2026-46638
Left out here: 201 versions. The JSON record has them.