Twig is a popular tool used to build dynamic page templates for PHP-based websites. A security flaw affects all Twig versions from 3.9.0 up to 3.26.0.
The issue relates to Twig’s built-in security sandbox, a feature designed to block untrusted or misconfigured templates from running code that could compromise your site. When the template_from_string() function (used to embed small custom content snippets into larger page templates) runs, it creates a tiny inner template with a special auto-generated name that can bypass the sandbox’s security checks. This means a sandboxed template that has access to both the template_from_string() and include functions could render that inner template without the site’s security rules being enforced.
This flaw is fully fixed in Twig version 3.26.0, so updating your Twig installation to that version or any newer release will resolve the vulnerability.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46634