Twig is a popular tool used to build dynamic content for PHP websites, managing tasks like reusable page layouts, personalized user-facing content, and other template-driven functionality. A security flaw has been identified in Twig versions 3.9.0 through 3.26.0 that impacts the platform's built-in sandbox security feature.
The sandbox is designed to block untrusted or malicious code from running on your website, but this bug lets a specific Twig function (used to turn plain text into executable templates) bypass sandbox checks when paired with include commands. If your site uses this function to process untrusted input (such as user-submitted comments, form data, or other public-facing content), a bad actor could potentially run unauthorized code on your site that would normally be restricted by the sandbox.
This issue has been fixed in Twig version 3.26.0.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46634