CVE-2026-46640
Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
CVSS Score
0.0
EPSS Score
0.3%
EPSS Percentile
26th
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.
| CWE | CWE-94 |
| Vendor | twigphp |
| Product | twig |
| Published | Jul 14, 2026 |
| Last Updated | Jul 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for twigphp twig
Be the first to know when new unknown vulnerabilities affecting twigphp twig are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
twigphp / Twig
>= 3.15.0, < 3.26.0