Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8 Patch
- https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3 Patch
- https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 2
Change history 1
- First seenCVSS 8.7 · symfonyNVD modified 2026-10-24 22:10
Affected (CPE criteria) 1
cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*
References 4
- https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8 Patch
- https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3 Patch
- https://github.com/twigphp/Twig/releases/tag/v3.26.0 Release Notes
- https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp Vendor Advisory