CVE-2026-46636
Twig: Sandbox method allowlist bypass via `Markup` subclass
HIGH 8.7
At a glance
- Source
- NVD
- EPSS
- EPSS 0.57 % · percentile 47 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Awaiting Analysis
Description
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.
Weaknesses (CWE)
- CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine
References
- https://github.com/twigphp/Twig/security/advisories/GHSA-64jr-qjx4-w2fh
- https://security-tracker.debian.org/tracker/CVE-2026-46636
- https://security-tracker.debian.org/tracker/DSA-6311-1
- https://symfony.com/blog/cve-2026-46636-sandbox-filter-tag-and-function-allow-list-bypass-when-sandbox-state-changes-between-renders
- http://github.com/twigphp/Twig/releases/tag/v3.27.0
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | GitHub_M |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · security-advisories@github.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-71779
- GCVE · GCVE-0-2026-46636
Affected products
| Product | Versions |
|---|---|
| twigphp · Twig | affected >= 1.0.0, < 3.27.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |