Twig, a PHP templating engine, had a vulnerability (CVE-2026-46633) in versions before 3.26.0 where the Compiler::string() method failed to escape single quotes in template names used in {% use %} tags. This flaw permits an attacker to terminate the single-quoted string literal in the compiled PHP cache file and inject arbitrary PHP expressions, leading to code injection. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). The issue is resolved in Twig version 3.26.0.

An attacker able to control template names in Twig prior to 3.26.0 can inject arbitrary PHP code into the compiled cache files. This can lead to remote code execution or other severe impacts depending on the context in which Twig is used. The CVSS 4.0 score is 8.7 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Twig to version 3.26.0 or later, where this vulnerability is fixed. No official patch or temporary fix is documented beyond this upgrade. Since this is a code injection vulnerability in the template compilation process, applying the official fix is critical to prevent exploitation.