What’s Vulnerable › Vulnerabilities

CVE-2026-46636: Twig: Sandbox method allowlist bypass via `Markup` subclass

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-25
• Weakness: CWE-1336

Description

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.

Affected products

• twigphp Twig: from 1.0.0, < 3.27.0

References

• http://github.com/twigphp/Twig/releases/tag/v3.27.0
• https://github.com/twigphp/Twig/security/advisories/GHSA-64jr-qjx4-w2fh
• https://security-tracker.debian.org/tracker/CVE-2026-46636
• https://security-tracker.debian.org/tracker/DSA-6311-1
• https://symfony.com/blog/cve-2026-46636-sandbox-filter-tag-and-function-allow-list-bypass-when-sandbox-state-changes-between-renders

Get alerted when CVE-2026-46636 or the next vulnerability affects your stack