A security flaw, tracked as CVE-2026-46634, has been identified in Twig, a popular tool used to build dynamic content for PHP websites. The issue impacts all Twig versions from 3.9.0 up to (but not including) 3.26.0. The flaw lets a template running in a restricted, locked-down security environment (called a sandbox, designed to block risky template actions) bypass its assigned security rules, if the template uses two standard Twig features: template_from_string and include. When this happens, extra content rendered by the template is not checked against the security limits set for the sandbox, which could allow unapproved or risky content to load on your site if you use this configuration. The Twig development team has already fixed this issue in version 3.26.0.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-46634