The vulnerability in php-twig affects versions prior to 3.26.0. Specifically, the Compiler::string() function fails to escape single quotes when a template name from a {% use %} tag is embedded inside a PHP single-quoted string literal. This improper escaping enables an attacker to craft a template name that terminates the string and injects arbitrary PHP expressions into the compiled cache file, potentially leading to code execution. The vulnerability is resolved in version 3.26.0.

An attacker able to control template names used in {% use %} tags can inject arbitrary PHP code into the compiled cache file, which may lead to remote code execution or unauthorized code execution within the context of the application using Twig. The vulnerability requires low attack complexity and no user interaction, but does require some privileges (PR:L). No known exploits in the wild have been reported.

Upgrade php-twig to version 3.26.0 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 3.26.0.