CVE-2026-46633 describes a code injection vulnerability in twigphp's Twig template engine. Specifically, before version 3.26.0, the Compiler::string() method fails to properly escape single quotes in template names used in {% use %} tags when these names are embedded in PHP single-quoted string literals. This flaw enables an attacker to terminate the string early and inject arbitrary PHP expressions into the compiled cache file, leading to code injection. The vulnerability is addressed by escaping single quotes correctly starting from version 3.26.0.

An attacker who can control the template name in a {% use %} tag can inject arbitrary PHP code into the compiled cache file. This can lead to remote code execution or other severe impacts depending on the environment and privileges of the PHP process. The CVSS 4.0 score is 8.7 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

This vulnerability is fixed in Twig version 3.26.0. Users should upgrade to version 3.26.0 or later to remediate this issue. No official patch or temporary workaround is indicated in the provided data. Patch status is not yet confirmed from vendor advisory; users should verify the vendor advisory for the latest remediation guidance.