Twig is a popular tool used to build dynamic content for PHP websites, such as reusable page layouts, personalized user displays, and consistent site components, without needing to rewrite the same code repeatedly.
A security flaw exists in Twig versions 3.9.0 up to 3.26.0 that impacts sites using Twig's sandbox feature, a built-in safeguard designed to restrict what certain templates can do to block malicious or unapproved code from running. The flaw allows a specially crafted template to bypass these sandbox restrictions, which could let unvetted code execute or sensitive site content be accessed that would normally be blocked.
This issue has been resolved in Twig version 3.26.0, which closes the gap that allowed the sandbox bypass.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46634