{"id":"CVE-2026-46638","published":"2026-07-14T21:23:50Z","modified":"2026-07-15T12:48:08Z","title":"Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)","vendor":"twigphp","product":"Twig","tier":"tail","description":{"text":"Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":6,"severity":"MEDIUM","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00473,"percentile":0.4089,"provenance":"source"},"cwes":[{"id":"CWE-693","name":"Protection Mechanism Failure"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-7fxw-r6jv-74c8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/twigphp/Twig/commit/819c6a89fe0f261b8555c4f4d5e27d31984223ea","tags":["x_refsource_MISC"]},{"url":"https://github.com/twigphp/Twig/releases/tag/v3.26.0","tags":["x_refsource_MISC"]}],"priority":{"score":12.4,"factors":[{"name":"EPSS percentile","points":8.18},{"name":"CVSS severity","points":4.2}]},"vendorSlug":"twigphp","affectedVersions":[{"vendor":"twigphp","product":"Twig","versions":["< 3.26.0"]}],"affected":[{"ecosystem":"Packagist","package":"twig/twig","vulnerableRanges":["<3.26.0"],"patched":["3.26.0"],"from":["GHSA-7fxw-r6jv-74c8"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-44570","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-twigphp-twig-cve-2022-23614","parents":[{"from":"CVE-2024-45411","to":"CVE-2026-46638","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-7fxw-r6jv-74c8","via":"reference","url":"https://github.com/advisories/GHSA-6j75-5wfj-gh66"}]}]}}