CVE-2026-46633

9.8 Critique

Publiée le 15/07/2026 à 00:16 · Modifiée le 16/07/2026 à 07:16 · Analysée par le NVD · Source : security-advisories@github.com

Description

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

Traduire en français

Produits concernés

twigphp Twig
Symfony twig

Scores CVSS

Version	Score	Source	Vecteur
4.0	8.7 Élevée	security-advisories@github.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.8 Critique	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94

Références

https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8 Patch
https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3 Patch
https://github.com/twigphp/Twig/releases/tag/v3.26.0 Release Notes
https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories