Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__<hash> name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version 3.26.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-20 | 1 | Disclosure1 |
| 2026-08-11 | 1 | Patch1 |
🔐 CVE-2026-46634: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name ➡️ https://symfony.com/blog/cve-2026-46634-template-from-string-escapes-a-sourcepolicy-driven-sandbox-via-synthesized-template-name
Post summary
The Symfony blog post announces CVE‑2026‑46634, detailing how `template_from_string()` can escape a SourcePolicy‑controlled sandbox through a synthesized template name.
Twig 3.9.0以上3.26.0未満で、template_from_string() が作る内部テンプレート名がサンドボックス判定の外に落ちます。書き手を信頼せずテンプレートを開放している構成が対象。修正は3.26.0。影響有無の切り分け方と更新前の緩和策をまとめました。 https://cve.autoarticles.net/cve/CVE-2026-46634
Post summary
The post highlights a sandbox‑bypass flaw in Twig 3.9.0–3.25.x, notes that the fix is available in 3.26.0, and outlines mitigations to use before updating.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | symfony | twig | - | - | - |