CVE-2026-46636: Twig Template Engine Auth Bypass Vulnerability

CVE-2026-46636 Overview

CVE-2026-46636 is a sandbox bypass vulnerability in Twig, a widely used template language for PHP. The flaw exists in SecurityPolicy::checkMethodAllowed(), which unconditionally whitelists every method call on instances of Twig\Markup. Because Twig\Markup is not declared final, any subclass inherits the bypass. Applications that pass a Markup-derived object into a sandboxed template to mark HTML as safe unintentionally expose every public method on that subclass to template authors. Affected versions range from 1.0.0 up to but not including 3.27.0. The issue is patched in Twig 3.27.0. This weakness is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Untrusted template authors can invoke arbitrary public methods on Markup subclasses, bypassing the sandbox allowedMethods allow-list and reaching application logic that was never intended to be reachable from templates.

Affected Products

Twig for PHP versions 1.0.0 through 3.26.x
Debian packages tracked under DSA-6311-1
Symfony applications embedding Twig with sandbox mode enabled

Discovery Timeline

2026-09-04 - CVE-2026-46636 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-46636

Vulnerability Analysis

Twig's sandbox extension enforces a SecurityPolicy that restricts which tags, filters, functions, methods, and properties a template can access. The checkMethodAllowed() method compares method calls against a configured allowedMethods list before permitting execution. To support the common pattern of marking pre-rendered HTML as safe, Twig short-circuits that check whenever the target object is an instance of Twig\Markup. The intent is to allow trivial operations such as string conversion on safe-HTML wrappers.

The short-circuit is unconditional and does not restrict itself to the base class. Any class extending Twig\Markup inherits the bypass. If an application passes a Markup subclass carrying business logic, storage handles, or user data into a sandboxed template, that template can invoke every public method on the subclass. Depending on the exposed methods, attackers with template authoring privileges may read sensitive data, mutate application state, or reach further sinks that lead to code execution.

Root Cause

The root cause is an overly broad instanceof Twig\Markup check inside SecurityPolicy::checkMethodAllowed() combined with Twig\Markup not being declared final. The policy trusts the type rather than the specific method being invoked, violating the principle of least privilege for template code.

Attack Vector

Exploitation requires the ability to author or influence sandboxed Twig templates in an application that also passes a Twig\Markup subclass into template context. The attacker crafts a template expression that invokes an unintended public method on the subclass. No authentication or user interaction is required at the network layer if untrusted template content is accepted from remote sources. See the GitHub Security Advisory GHSA-64jr-qjx4-w2fh and the Symfony Blog CVE-2026-46636 Analysis for the maintainer write-up.

Detection Methods for CVE-2026-46636

Indicators of Compromise

Unexpected method invocations on Markup-derived classes appearing in PHP application logs or Twig profiler traces
Sandboxed templates containing method-call syntax such as {{ safeHtml.someInternalMethod() }} against objects that should only be rendered as strings
Anomalous access to application services, repositories, or entity methods originating from template rendering call stacks

Detection Strategies

Perform a static code review to enumerate every class extending Twig\Markup and audit their public method surface for sensitive operations
Grep template repositories for method-call syntax applied to variables known to be Markup subclass instances
Use dependency scanners to flag twig/twig versions earlier than 3.27.0 in composer.lock files across your estate

Monitoring Recommendations

Log all sandbox policy evaluations in non-production to baseline expected method calls, then alert on deviations in production
Instrument Twig rendering with application performance monitoring to capture call stacks that unexpectedly reach domain services from template code
Track outbound data volumes from services that render user-supplied templates to detect abuse patterns

How to Mitigate CVE-2026-46636

Immediate Actions Required

Upgrade twig/twig to version 3.27.0 or later using composer update twig/twig and redeploy affected applications
Apply distribution updates such as Debian DSA-6311-1 on managed servers
Inventory all classes extending Twig\Markup and evaluate whether they need to be passed into sandboxed templates at all

Patch Information

The vulnerability is fixed in Twig 3.27.0. Release notes are available at the GitHub Twig Release v3.27.0 page. The fix tightens SecurityPolicy::checkMethodAllowed() so that the Markup short-circuit no longer grants blanket method access to subclasses. Debian tracking is available via the Debian CVE-2026-46636 Tracker.

Workarounds

Refactor Markup subclasses to remove sensitive public methods, or wrap safe HTML in the base Twig\Markup class directly instead of a subclass
Declare application-specific Markup subclasses as final and expose only string-conversion methods until patching is possible
Restrict which users can author or upload Twig templates and treat all template input as untrusted code

bash

# Upgrade Twig via Composer to the patched release
composer require twig/twig:^3.27.0
composer update twig/twig

# Verify the installed version
composer show twig/twig | grep versions