CVE-2026-46639 Overview
CVE-2026-46639 is a sandbox bypass vulnerability in Twig, a template language for PHP maintained by Symfony. The flaw affects Twig versions 3.24.0 through 3.25.x and is fixed in 3.26.0. Object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks. An attacker with write access to a sandboxed Twig template can read public properties or invoke public getters on objects passed to the template engine. The vulnerability maps to [CWE-693] Protection Mechanism Failure.
Critical Impact
Attackers with write access to sandboxed Twig templates can bypass the sandbox and access public properties and getters on host objects, exposing sensitive application data.
Affected Products
- Symfony Twig 3.24.0
- Symfony Twig versions up to but not including 3.26.0
- PHP applications using Twig sandbox extension with object-destructuring syntax
Discovery Timeline
- 2026-07-14 - CVE-2026-46639 published to NVD
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-46639
Vulnerability Analysis
Twig provides a sandbox extension that restricts which properties, methods, functions, filters, and tags a template can use. The sandbox is enforced at runtime through the CoreExtension::getAttribute() function, which accepts a boolean sandbox argument controlling whether policy checks execute.
Starting in Twig 3.24.0, the parser added support for object-destructuring assignment. The compiler responsible for translating this syntax into PHP emits calls to CoreExtension::getAttribute() with the sandbox argument hardcoded to false. As a result, property reads and getter invocations performed through destructuring skip the security policy entirely.
The impact is confined to environments where untrusted users can author or modify sandboxed templates. Confidentiality of any public property or public getter on objects reachable from the template context is at risk.
Root Cause
The root cause is an insecure default passed by the destructuring compiler. Other attribute-access paths in Twig correctly propagate the sandbox flag from the runtime environment. The destructuring codegen path did not, resulting in a protection mechanism failure classified as [CWE-693].
Attack Vector
Exploitation requires an attacker to have write access to a sandboxed Twig template and the ability to render it against objects the application exposes to the engine. The attacker crafts a destructuring expression that reads properties or invokes getters normally blocked by the SecurityPolicy. See the GitHub Security Advisory GHSA-mm6w-gr99-p3jj for the technical description.
Detection Methods for CVE-2026-46639
Indicators of Compromise
- Sandboxed Twig templates containing destructuring assignment syntax that references object properties not permitted by the active SecurityPolicy.
- Application logs showing template rendering of user-modified templates followed by disclosure of sensitive object data.
- Deployed Twig package versions between 3.24.0 and 3.25.x in composer.lock files.
Detection Strategies
- Inventory PHP applications and enumerate Twig versions using composer show twig/twig to identify affected installations.
- Scan template repositories for destructuring assignment syntax in files rendered under the sandbox extension.
- Review Twig SecurityPolicy configurations and compare permitted properties against those reachable through destructuring in existing templates.
Monitoring Recommendations
- Enable audit logging for any workflow that permits users to create or edit Twig templates.
- Monitor web application logs for anomalous response sizes or content when rendering user-authored templates.
- Track dependency updates in CI pipelines to flag Twig versions below 3.26.0.
How to Mitigate CVE-2026-46639
Immediate Actions Required
- Upgrade Twig to version 3.26.0 or later using composer require twig/twig:^3.26.0.
- Audit all sandboxed templates that accept untrusted authorship for destructuring assignment expressions.
- Restrict template write access to trusted authors until patching completes.
Patch Information
The issue is resolved in Twig 3.26.0. The release notes are available at GitHub Release v3.26.0. The patch ensures the destructuring compiler propagates the sandbox flag to CoreExtension::getAttribute() so that SecurityPolicy checks apply consistently.
Workarounds
- Disallow destructuring assignment in sandboxed templates by rejecting templates that contain the syntax at submission time.
- Remove sensitive objects from the template context passed to sandboxed renders until the patch is deployed.
- Reduce the set of users with write access to Twig templates rendered through the sandbox extension.
# Upgrade Twig to the patched release
composer require twig/twig:^3.26.0
composer update twig/twig
# Verify the installed version
composer show twig/twig | grep versions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
