CVE-2026-46634: Symfony Twig RCE Vulnerability

CVE-2026-46634 Overview

CVE-2026-46634 is a sandbox bypass vulnerability in Twig, a widely-used template language for PHP maintained by Symfony. The flaw affects versions from 3.9.0 up to but not including 3.26.0. The template_from_string() function compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision. A sandboxed template that can call template_from_string and include can render an inner template without security policy enforcement. This categorizes as an Authorization Bypass and Security Feature Bypass issue tracked under [CWE-693]. The vendor fixed the issue in Twig version 3.26.0.

Critical Impact
Sandboxed Twig templates can bypass SourcePolicyInterface restrictions and execute template code outside the intended security boundary, undermining tenant isolation in multi-tenant PHP applications.

Affected Products

Symfony Twig versions 3.9.0 through 3.25.x
PHP applications embedding Twig for user-supplied template rendering
Multi-tenant platforms relying on Twig's sandbox extension with custom SourcePolicyInterface

Discovery Timeline

2026-07-14 - CVE-2026-46634 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-46634

Vulnerability Analysis

Twig provides a sandbox extension that restricts which tags, filters, functions, methods, and properties untrusted templates can access. Applications can implement SourcePolicyInterface to make sandbox decisions based on a template's source identity. The vulnerability stems from how template_from_string() names the templates it compiles at runtime.

When a template invokes template_from_string(), Twig compiles the resulting inner template under a synthesized name of the form __string_template__<hash>. Sandbox source policies that key their decisions on the loader-provided template name never see this synthetic identifier as a recognized source. The policy either returns a permissive default or fails to match, letting the compiled inner template execute outside the sandbox boundary. An attacker able to inject content into a template that reaches template_from_string() followed by include can execute Twig constructs the outer sandbox would have blocked.

Root Cause

The root cause is inconsistent enforcement of the security policy across template sources [CWE-693]. The runtime-synthesized __string_template__<hash> name is not propagated as a policy-checked source, so SourcePolicyInterface implementations cannot render a deny decision for it. The trust boundary that the sandbox extension is supposed to guarantee does not extend to templates created through string compilation.

Attack Vector

Exploitation requires an attacker to control template content evaluated inside a sandboxed Twig environment where template_from_string and include are callable. Typical exposure includes content management systems, email or notification templates, and low-code platforms that let tenants author Twig snippets. The attacker crafts a template that calls template_from_string() with a payload, then includes the resulting inner template to run tags, filters, or function calls that the outer sandbox would otherwise reject. Successful exploitation yields confidentiality, integrity, and availability impact on data reachable from the PHP process.

No public proof-of-concept exploit code is available at this time. Refer to the GitHub Security Advisory GHSA-24x9-r6q4-q93w for maintainer analysis.

Detection Methods for CVE-2026-46634

Indicators of Compromise

Twig cache directories containing compiled classes with names matching the __string_template__[a-f0-9]+ pattern originating from user-authored templates.
PHP error or audit logs showing invocations of template_from_string from templates that should be sandboxed.
Unexpected outbound requests, file reads, or object method calls originating from PHP-FPM workers rendering tenant templates.

Detection Strategies

Perform dependency inventory across PHP projects to identify installations of twig/twig at versions between 3.9.0 and 3.25.x using Composer lock files.
Enable Twig sandbox logging and audit for use of the template_from_string function and include tag within tenant-authored templates.
Correlate web application logs with PHP process telemetry to surface template rendering paths that touch dynamic string compilation.

Monitoring Recommendations

Alert on newly created files in Twig's compilation cache whose class names begin with __TwigTemplate_ and reference __string_template__ sources.
Baseline the set of Twig functions permitted by each tenant's SourcePolicyInterface and alert on deviations in production traffic.
Track version drift of the twig/twig package across build pipelines to catch environments that remain below 3.26.0.

How to Mitigate CVE-2026-46634

Immediate Actions Required

Upgrade twig/twig to version 3.26.0 or later across all applications and build artifacts.
Audit tenant-authored templates for calls to template_from_string and include and quarantine suspicious content pending review.
Rotate any secrets exposed to the PHP application if template injection abuse is suspected, since sandbox escape grants access to configured Twig functions and objects.

Patch Information

The fix is included in Twig 3.26.0. Review the maintainer's GitHub Commit Details and the GitHub Release v3.26.0 notes for the code change that propagates policy checks to string-compiled templates. The GitHub Security Advisory GHSA-24x9-r6q4-q93w documents the affected version range.

Workarounds

Remove template_from_string from the list of allowed functions in the Twig sandbox SecurityPolicy configuration until the upgrade is deployed.
Disable the include tag for untrusted template contexts, or restrict it to templates loaded from the trusted loader.
Deploy a web application firewall rule that inspects submitted template content for the template_from_string( token and blocks it in tenant input fields.

bash

# Upgrade Twig to the patched release using Composer
composer require twig/twig:^3.26.0
composer update twig/twig

# Verify the installed version
composer show twig/twig | grep versions