High severity · published Sep 4, 2026
CVE-2026-46636
Twig: Sandbox method allowlist bypass via `Markup` subclass
8.7
CVSS
0.6%
EPSS
No
On KEV
Description
Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twig · twigphp
>= 1.0.0, < 3.27.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46636
github.com
http://github.com/twigphp/Twig/releases/tag/v3.27.0
github.com
https://github.com/twigphp/Twig/security/advisories/GHSA-64jr-qjx4-w2fh
security-tracker.debian.org
https://security-tracker.debian.org/tracker/CVE-2026-46636
security-tracker.debian.org
https://security-tracker.debian.org/tracker/DSA-6311-1
symfony.com
https://symfony.com/blog/cve-2026-46636-sandbox-filter-tag-and-function-allow-list-bypass-when-sandbox-state-changes-between-renders
More from Twig
9.9
CVE-2026-24425
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
9.8
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
9.8
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
9.1
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
9.1
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys