{"schema":"threatline.record/2","record":{"id":"CVE-2026-46633","aliases":["GHSA-7p85-w9px-jpjp"],"summary":"Twig: PHP code injection via `{% use %}` template name","details":"Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.","categories":["Libraries & packages"],"product":"Twig","vendor":"twigphp","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-46633","source_modified_at":"2026-07-16T03:55:36.587Z","fetched_at":"2026-10-24T23:06:24.700873Z","product":"Twig","vendor":"twigphp","versions":[{"version":"< 3.26.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp","source_modified_at":"2026-09-10T03:50:46.236628412Z","fetched_at":"2026-10-24T23:06:24.700873Z","package":{"name":"twig/twig","ecosystem":"Packagist","purl":"pkg:composer/twig/twig"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0"}]}],"versions":["1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","v1.10.0","v1.10.1","v1.10.2","v1.10.3","v1.11.0","v1.11.1","v1.12.0","v1.12.0-RC1","v1.12.1","v1.12.2","v1.12.3","v1.13.0","v1.13.1","v1.13.2","v1.14.0","v1.14.1","v1.14.2","v1.15.0","v1.15.1","v1.16.0","v1.16.1","v1.16.2","v1.16.3","v1.17.0","v1.18.0","v1.18.1","v1.18.2","v1.19.0","v1.20.0","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.22.1","v1.22.2","v1.22.3","v1.23.0","v1.23.1","v1.23.2","v1.23.3"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp","source_modified_at":"2026-09-10T03:50:46.236628412Z","fetched_at":"2026-10-24T23:06:24.700873Z","package":{"name":"twig/twig","ecosystem":"Packagist","purl":"pkg:composer/twig/twig"},"version":"3.26.0"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00688,"percentile":0.52211,"score_date":"2026-10-24"},"published_at":"2026-07-14T21:14:24.916Z","modified_at":"2026-09-10T03:50:46.236628412Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-46633","fetched_at":"2026-10-24T23:06:24.700873Z","source_modified_at":"2026-07-16T03:55:36.587Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp","fetched_at":"2026-10-24T23:06:24.700873Z","source_modified_at":"2026-09-10T03:50:46.236628412Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46633","fetched_at":"2026-10-24T23:06:24.700873Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/twigphp/Twig/releases/tag/v3.26.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-07-15T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-10T03:50:46.236628412Z","content_hash":"aa866408553bc2053ee127fdc3b542a814ab8b618187e3ba911403b67eb47f99"}}