CVE-2026-46634 describes a vulnerability in twigphp's Twig template engine where the template_from_string() function, present in versions 3.9.0 through 3.25.x, compiles inner templates under synthesized names that may fall outside the scope of the SourcePolicyInterface sandbox. This allows a sandboxed template that can call template_from_string and include to render an inner template without the sandbox's security policy being applied, constituting a protection mechanism failure (CWE-693). The vulnerability is addressed in Twig version 3.26.0.

An attacker able to execute sandboxed templates could bypass sandbox restrictions and render inner templates without security policy enforcement, potentially leading to unauthorized code execution or information disclosure within the sandboxed environment. The CVSS 4.0 score of 7.7 (high severity) reflects the network attack vector, low attack complexity, partial privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

This vulnerability is fixed in Twig version 3.26.0. Users should upgrade to version 3.26.0 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Since this is not a cloud service, remediation depends on user action to update the affected software.