CVE-2026-46636: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine in twigphp Twig

Twig, a PHP template engine, has a security vulnerability (CVE-2026-46636) in versions >=1.0.0 and <3.27.0 where SecurityPolicy::checkMethodAllowed() improperly whitelists all method calls on Twig\Markup instances. Since Twig\Markup is not a final class, subclasses inherit this bypass, enabling sandboxed templates to invoke any public method on Markup-derived objects regardless of the allowedMethods configuration. This improper neutralization of special elements used in the template engine could lead to unauthorized method execution within sandboxed templates. The vulnerability has been patched in version 3.27.0.

An attacker with the ability to supply objects of Markup-derived classes into sandboxed templates can invoke any public method on those objects, bypassing method call restrictions. This can lead to unauthorized actions or information disclosure within the context of the template execution environment. The CVSS 4.0 score is 8.7 (high severity), indicating a significant impact with network attack vector, low attack complexity, no privileges or user interaction required, and high vulnerability and confidentiality impact.

Upgrade Twig to version 3.27.0 or later, where this vulnerability has been fixed. No other mitigations are indicated or recommended by the vendor advisory. Patch status is confirmed by the vendor advisory stating the issue is resolved in 3.27.0.