Twig: PHP code injection via template name in {% use %} (CVE-2026-46633)
A vulnerability, CVE-2026-46633 (CVSS 8.7), was published for Twig, a template language for PHP. Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed in a PHP single-quoted string. A crafted name can break out of the string and inject PHP expressions into the compiled cache file.
Checked in Shield: no
Who is affected
Twig from 1.15.1 up to but not including 3.26.0. The risk applies where a template name in {% use %} can be crafted by an attacker.
How to check
Run `composer show twig/twig` or search for twig in composer.lock. Also make sure template names in {% use %} are not built from user input.
How to fix
A patch exists: update Twig to version 3.26.0 or newer.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
Whether the issue is exploited in the wild is not disclosed yet. Source: NVD (CVE-2026-46633).
