Php twig: Twig is a template language for PHP. (CVE-2026-46636)
Description
Twig is a PHP template language with a vulnerability in versions from 1.0.0 up to but not including 3.27.0. The SecurityPolicy::checkMethodAllowed() function incorrectly whitelists all method calls on instances of Twig\Markup and its subclasses, allowing sandboxed templates to access every public method of these subclasses regardless of configured restrictions. This issue has been fixed in version 3.27.0.
CVSS v4.0
Affected software
pkg:deb/ubuntu/php-twig?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/php-twig?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/php-twig?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/php-twig?arch=source&distro=questingpkg:deb/ubuntu/php-twig?arch=source&distro=stonkingpkg:deb/ubuntu/php-twig?arch=source&distro=esm-apps/resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Twig affects versions 1.0.0 through before 3.27.0, where the SecurityPolicy::checkMethodAllowed() method unconditionally allows all method calls on instances of Twig\Markup. Since Twig\Markup is not a final class, subclasses inherit this bypass, enabling sandboxed templates to invoke any public method on objects derived from Twig\Markup, bypassing the intended allowedMethods restrictions. This flaw is addressed in Twig version 3.27.0.
Potential Impact
An application passing an object of a Markup-derived class into a sandboxed Twig template inadvertently exposes all public methods of that subclass to template authors, potentially allowing unauthorized method invocation within the sandboxed environment. This could lead to unintended behavior or information disclosure depending on the subclass methods exposed.
Mitigation Recommendations
This vulnerability has been patched in Twig version 3.27.0. Users should upgrade to version 3.27.0 or later to remediate this issue. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-46636
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.10","Ubuntu:Pro:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f6512cdf04f656665d07
Added to database: 10/17/2026, 22:27:29 UTC
Last enriched: 10/18/2026, 01:27:56 UTC
Last updated: 10/18/2026, 01:27:56 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.