CVE-2026-46633
Riassunto
di MITRE • 14/07/2026
Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.