CVE-2026-46640

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46640", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-15T20:11:54.584Z", "datePublished": "2026-07-14T21:22:57.332Z", "dateUpdated": "2026-07-16T03:55:34.985Z"}, "containers": {"cna": {"title": "Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8"}, {"name": "https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2", "tags": ["x_refsource_MISC"], "url": "https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2"}, {"name": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0"}], "affected": [{"vendor": "twigphp", "product": "Twig", "versions": [{"version": ">= 3.15.0, < 3.26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:22:57.332Z"}, "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0."}], "source": {"advisory": "GHSA-45vw-wh46-2vx8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-46640"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T03:55:34.985Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46640", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T14:32:30.432781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:32:34.041Z"}}], "cna": {"title": "Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation", "source": {"advisory": "GHSA-45vw-wh46-2vx8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "twigphp", "product": "Twig", "versions": [{"status": "affected", "version": ">= 3.15.0, < 3.26.0"}]}], "references": [{"url": "https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8", "name": "https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2", "name": "https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "name": "https://github.com/twigphp/Twig/releases/tag/v3.26.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-14T21:22:57.332Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46640", "state": "PUBLISHED", "dateUpdated": "2026-07-16T03:55:34.985Z", "dateReserved": "2026-05-15T20:11:54.584Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-14T21:22:57.332Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Twig", "vendor": "twigphp", "versions": [{"status": "affected", "version": ">= 3.15.0, < 3.26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*", "matchCriteriaId": "D53EE105-E789-42FE-8447-8C48CC159B45", "versionEndExcluding": "3.26.0", "versionStartIncluding": "3.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0."}, {"lang": "es", "value": "Twig es un lenguaje de plantillas para PHP. Desde la versi\u00f3n 3.15.0 hasta la 3.26.0, _self.([string]) y la sintaxis de atributo din\u00e1mico import-alias pueden concatenar una cadena controlada por un atacante en un nombre de MacroReferenceExpression sin validaci\u00f3n de identificador, lo que provoca que se emita PHP sin procesar en el c\u00f3digo fuente de la plantilla generada y se ejecute en el momento de la carga de la plantilla. Este problema est\u00e1 corregido en la versi\u00f3n 3.26.0."}], "id": "CVE-2026-46640", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46640", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-07-14T22:16:56.840", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/twigphp/Twig/releases/tag/v3.26.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.15.0,3.26.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Twig", "source": "cna", "vendor": "twigphp"}, "product": "twig", "vendor": "twigphp"}], "created": "2026-07-15T15:00:04.453567+00:00", "updated": "2026-07-31T04:45:17.058081+00:00", "vendors": ["twigphp", "twigphp$PRODUCT$twig"]}