CVE-2026-46633: Symfony Twig RCE Vulnerability

CVE-2026-46633 Overview

CVE-2026-46633 is a code injection vulnerability in Twig, the template language for PHP maintained by Symfony. The flaw exists in the Compiler::string() method, which fails to escape single quotes when a template name from a {% use %} tag is embedded in a PHP single-quoted string literal. A crafted template name can terminate the string and inject arbitrary PHP expressions into the compiled cache file. The issue affects Twig versions prior to 3.26.0 and is classified as CWE-94: Improper Control of Generation of Code.

Critical Impact
Attackers who control template names passed to {% use %} can inject arbitrary PHP code into compiled Twig cache files, leading to remote code execution on the server.

Affected Products

Symfony Twig versions prior to 3.26.0
PHP applications using Twig for template rendering with attacker-influenced template names
Content management systems and frameworks bundling vulnerable Twig releases

Discovery Timeline

2026-07-14 - CVE-2026-46633 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-46633

Vulnerability Analysis

Twig compiles templates into PHP source files that are cached for subsequent execution. During compilation, the Compiler::string() helper wraps values in single-quoted PHP string literals and is expected to escape any embedded single quotes. When Twig processes a {% use %} directive, the referenced template name is passed through this helper. Prior to version 3.26.0, single quotes in the template name are not escaped before insertion into the generated PHP source. An attacker who can control the template name argument passed to {% use %} can close the string literal and append arbitrary PHP expressions that are written verbatim into the cache file and executed the next time the template is rendered.

Root Cause

The root cause is missing input sanitization in Compiler::string(). Single quote characters within the template name reach the compiled output unchanged, breaking the string literal boundary. This is a classic code generation flaw where untrusted input is concatenated into a code context without proper escaping.

Attack Vector

Exploitation requires that the application allow user-influenced values to reach the template name argument of a {% use %} tag. This is most common in applications that dynamically construct templates from database records, user-generated themes, or multi-tenant template stores. The attacker supplies a template name containing a single quote followed by PHP syntax. When Twig compiles the parent template, the injected PHP is written into the cache file and executed on the next render, yielding remote code execution under the web server user.

The vulnerability manifests during template compilation and does not require direct write access to the cache directory. See the GitHub Security Advisory GHSA-7p85-w9px-jpjp for the vendor's technical description.

Detection Methods for CVE-2026-46633

Indicators of Compromise

Unexpected PHP files or modifications in the Twig compilation cache directory (commonly var/cache/)
Compiled template files containing PHP constructs such as system(, passthru(, eval(, or base64_decode( outside of legitimate template output
Web server process spawning unexpected child processes (shells, network utilities) after template rendering
Template names in application logs containing single quote characters or PHP syntax fragments

Detection Strategies

Inventory installed Twig versions across PHP applications using composer show twig/twig and flag anything below 3.26.0
Review application source code for {% use %} tags whose template name derives from user input, database content, or external configuration
Enable file integrity monitoring on Twig cache directories to alert on unexpected writes or content changes
Correlate web request logs with cache file mutations to identify suspicious template compilation events

Monitoring Recommendations

Monitor process creation events from PHP-FPM and web server workers for shell or interpreter spawns
Alert on outbound network connections initiated by the web server user to non-approved destinations
Log and review all Twig template loading events, particularly those referencing dynamic template names

How to Mitigate CVE-2026-46633

Immediate Actions Required

Upgrade Twig to version 3.26.0 or later using composer require twig/twig:^3.26.0
Purge existing compiled template caches after upgrade to remove any potentially poisoned cache files
Audit application code paths that expose template names to untrusted input and restrict them to an allowlist

Patch Information

The issue is fixed in Twig 3.26.0. The upstream fix escapes single quotes in Compiler::string() and is delivered in commits 679447fa and e9ff55f6. Release notes are published at Twig v3.26.0.

Workarounds

Validate template names against a strict allowlist of known identifiers before passing them to Twig
Reject any template name containing single quotes, backticks, or PHP syntax characters at the application boundary
Restrict filesystem permissions on the Twig cache directory so that only the compilation process can write to it, limiting persistence of injected payloads

bash

# Upgrade Twig to the patched release
composer require twig/twig:^3.26.0

# Clear compiled template caches (Symfony example)
php bin/console cache:pool:clear cache.global_clearer
rm -rf var/cache/*/twig