This security notice applies to PHP-powered websites that use the Twig template tool, a popular utility developers use to build consistent page layouts and reusable content components.
If your site uses Twig version 3.9.0 up to 3.26.0 and has Twig's sandbox feature enabled (a built-in security tool designed to restrict what templates can do to block unauthorized or malicious activity), there is a gap in that protection. When the Twig function template_from_string() is used alongside the include feature to load smaller inner templates, those inner templates may bypass the sandbox's security checks, meaning the sandbox's intended restrictions may not apply to them.
This issue is fully resolved in Twig version 3.26.0 and later releases.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46634