{"affected":[{"product":"Twig","source":"CNA: GitHub_M","vendor":"twigphp","versions":[{"status":"affected","version":">= 1.15.1, < 3.26.0"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"twig/twig","product":"twig/twig","source":"OSV GHSA-7p85-w9px-jpjp","vendor":"","versions":[{"status":"affected","version":"v1.15.1","versionType":"Packagist"},{"status":"affected","version":"v1.16.0","versionType":"Packagist"},{"status":"affected","version":"v1.16.1","versionType":"Packagist"},{"status":"affected","version":"v1.16.2","versionType":"Packagist"},{"status":"affected","version":"v1.16.3","versionType":"Packagist"},{"status":"affected","version":"v1.17.0","versionType":"Packagist"},{"status":"affected","version":"v1.18.0","versionType":"Packagist"},{"status":"affected","version":"v1.18.1","versionType":"Packagist"},{"status":"affected","version":"v1.18.2","versionType":"Packagist"},{"status":"affected","version":"v1.19.0","versionType":"Packagist"},{"status":"affected","version":"v1.20.0","versionType":"Packagist"},{"status":"affected","version":"v1.21.0","versionType":"Packagist"},{"status":"affected","version":"v1.21.1","versionType":"Packagist"},{"status":"affected","version":"v1.21.2","versionType":"Packagist"},{"status":"affected","version":"v1.22.0","versionType":"Packagist"},{"status":"affected","version":"v1.22.1","versionType":"Packagist"},{"status":"affected","version":"v1.22.2","versionType":"Packagist"},{"status":"affected","version":"v1.22.3","versionType":"Packagist"},{"status":"affected","version":"v1.23.0","versionType":"Packagist"},{"status":"affected","version":"v1.23.1","versionType":"Packagist"},{"status":"affected","version":"v1.23.2","versionType":"Packagist"},{"status":"affected","version":"v1.23.3","versionType":"Packagist"},{"status":"affected","version":"v1.24.0","versionType":"Packagist"},{"status":"affected","version":"v1.24.1","versionType":"Packagist"},{"status":"affected","version":"v1.24.2","versionType":"Packagist"},{"status":"affected","version":"v1.25.0","versionType":"Packagist"},{"status":"affected","version":"v1.26.0","versionType":"Packagist"},{"status":"affected","version":"v1.26.1","versionType":"Packagist"},{"status":"affected","version":"v1.27.0","versionType":"Packagist"},{"status":"affected","version":"v1.28.0","versionType":"Packagist"},{"status":"affected","version":"v1.28.1","versionType":"Packagist"},{"status":"affected","version":"v1.28.2","versionType":"Packagist"},{"status":"affected","version":"v1.29.0","versionType":"Packagist"},{"status":"affected","version":"v1.30.0","versionType":"Packagist"},{"status":"affected","version":"v1.31.0","versionType":"Packagist"},{"status":"affected","version":"v1.32.0","versionType":"Packagist"},{"status":"affected","version":"v1.33.0","versionType":"Packagist"},{"status":"affected","version":"v1.33.1","versionType":"Packagist"},{"status":"affected","version":"v1.33.2","versionType":"Packagist"},{"status":"affected","version":"v1.34.0","versionType":"Packagist"},{"status":"affected","version":"v1.34.1","versionType":"Packagist"},{"status":"affected","version":"v1.34.2","versionType":"Packagist"},{"status":"affected","version":"v1.34.3","versionType":"Packagist"},{"status":"affected","version":"v1.34.4","versionType":"Packagist"},{"status":"affected","version":"v1.35.0","versionType":"Packagist"},{"status":"affected","version":"v1.35.1","versionType":"Packagist"},{"status":"affected","version":"v1.35.2","versionType":"Packagist"},{"status":"affected","version":"v1.35.3","versionType":"Packagist"},{"status":"affected","version":"v1.35.4","versionType":"Packagist"},{"status":"affected","version":"v1.36.0","versionType":"Packagist"},{"status":"affected","version":"v1.37.0","versionType":"Packagist"},{"status":"affected","version":"v1.37.1","versionType":"Packagist"},{"status":"affected","version":"v1.38.0","versionType":"Packagist"},{"status":"affected","version":"v1.38.1","versionType":"Packagist"},{"status":"affected","version":"v1.38.2","versionType":"Packagist"},{"status":"affected","version":"v1.38.3","versionType":"Packagist"},{"status":"affected","version":"v1.38.4","versionType":"Packagist"},{"status":"affected","version":"v1.39.0","versionType":"Packagist"},{"status":"affected","version":"v1.39.1","versionType":"Packagist"},{"status":"affected","version":"v1.40.0","versionType":"Packagist"},{"status":"affected","version":"v1.40.1","versionType":"Packagist"},{"status":"affected","version":"v1.41.0","versionType":"Packagist"},{"status":"affected","version":"v1.42.0","versionType":"Packagist"},{"status":"affected","version":"v1.42.1","versionType":"Packagist"},{"status":"affected","version":"v1.42.2","versionType":"Packagist"},{"status":"affected","version":"v1.42.3","versionType":"Packagist"},{"status":"affected","version":"v1.42.4","versionType":"Packagist"},{"status":"affected","version":"v1.42.5","versionType":"Packagist"},{"status":"affected","version":"v1.43.0","versionType":"Packagist"},{"status":"affected","version":"v1.43.1","versionType":"Packagist"},{"status":"affected","version":"v1.44.0","versionType":"Packagist"},{"status":"affected","version":"v1.44.1","versionType":"Packagist"},{"status":"affected","version":"v1.44.2","versionType":"Packagist"},{"status":"affected","version":"v1.44.3","versionType":"Packagist"},{"status":"affected","version":"v1.44.4","versionType":"Packagist"},{"status":"affected","version":"v1.44.5","versionType":"Packagist"},{"status":"affected","version":"v1.44.6","versionType":"Packagist"},{"status":"affected","version":"v1.44.7","versionType":"Packagist"},{"status":"affected","version":"v1.44.8","versionType":"Packagist"},{"status":"affected","version":"v2.0.0","versionType":"Packagist"},{"status":"affected","version":"v2.1.0","versionType":"Packagist"},{"status":"affected","version":"v2.10.0","versionType":"Packagist"},{"status":"affected","version":"v2.11.0","versionType":"Packagist"},{"status":"affected","version":"v2.11.1","versionType":"Packagist"},{"status":"affected","version":"v2.11.2","versionType":"Packagist"},{"status":"affected","version":"v2.11.3","versionType":"Packagist"},{"status":"affected","version":"v2.12.0","versionType":"Packagist"},{"status":"affected","version":"v2.12.1","versionType":"Packagist"},{"status":"affected","version":"v2.12.2","versionType":"Packagist"},{"status":"affected","version":"v2.12.3","versionType":"Packagist"},{"status":"affected","version":"v2.12.4","versionType":"Packagist"},{"status":"affected","version":"v2.12.5","versionType":"Packagist"},{"status":"affected","version":"v2.13.0","versionType":"Packagist"},{"status":"affected","version":"v2.13.1","versionType":"Packagist"},{"status":"affected","version":"v2.14.0","versionType":"Packagist"},{"status":"affected","version":"v2.14.1","versionType":"Packagist"},{"status":"affected","version":"v2.14.10","versionType":"Packagist"},{"status":"affected","version":"v2.14.11","versionType":"Packagist"},{"status":"affected","version":"v2.14.12","versionType":"Packagist"},{"status":"affected","version":"v2.14.13","versionType":"Packagist"},{"status":"affected","version":"v2.14.2","versionType":"Packagist"},{"status":"affected","version":"v2.14.3","versionType":"Packagist"},{"status":"affected","version":"v2.14.4","versionType":"Packagist"},{"status":"affected","version":"v2.14.5","versionType":"Packagist"},{"status":"affected","version":"v2.14.6","versionType":"Packagist"},{"status":"affected","version":"v2.14.7","versionType":"Packagist"},{"status":"affected","version":"v2.14.8","versionType":"Packagist"},{"status":"affected","version":"v2.14.9","versionType":"Packagist"},{"status":"affected","version":"v2.15.0","versionType":"Packagist"},{"status":"affected","version":"v2.15.1","versionType":"Packagist"},{"status":"affected","version":"v2.15.2","versionType":"Packagist"},{"status":"affected","version":"v2.15.3","versionType":"Packagist"},{"status":"affected","version":"v2.15.4","versionType":"Packagist"},{"status":"affected","version":"v2.15.5","versionType":"Packagist"},{"status":"affected","version":"v2.15.6","versionType":"Packagist"},{"status":"affected","version":"v2.16.0","versionType":"Packagist"},{"status":"affected","version":"v2.16.1","versionType":"Packagist"},{"status":"affected","version":"v2.2.0","versionType":"Packagist"},{"status":"affected","version":"v2.3.0","versionType":"Packagist"},{"status":"affected","version":"v2.3.1","versionType":"Packagist"},{"status":"affected","version":"v2.3.2","versionType":"Packagist"},{"status":"affected","version":"v2.4.0","versionType":"Packagist"},{"status":"affected","version":"v2.4.1","versionType":"Packagist"},{"status":"affected","version":"v2.4.2","versionType":"Packagist"},{"status":"affected","version":"v2.4.3","versionType":"Packagist"},{"status":"affected","version":"v2.4.4","versionType":"Packagist"},{"status":"affected","version":"v2.4.5","versionType":"Packagist"},{"status":"affected","version":"v2.4.6","versionType":"Packagist"},{"status":"affected","version":"v2.4.7","versionType":"Packagist"},{"status":"affected","version":"v2.4.8","versionType":"Packagist"},{"status":"affected","version":"v2.5.0","versionType":"Packagist"},{"status":"affected","version":"v2.6.0","versionType":"Packagist"},{"status":"affected","version":"v2.6.1","versionType":"Packagist"},{"status":"affected","version":"v2.6.2","versionType":"Packagist"},{"status":"affected","version":"v2.7.0","versionType":"Packagist"},{"status":"affected","version":"v2.7.1","versionType":"Packagist"},{"status":"affected","version":"v2.7.2","versionType":"Packagist"},{"status":"affected","version":"v2.7.3","versionType":"Packagist"},{"status":"affected","version":"v2.7.4","versionType":"Packagist"},{"status":"affected","version":"v2.8.0","versionType":"Packagist"},{"status":"affected","version":"v2.8.1","versionType":"Packagist"},{"status":"affected","version":"v2.9.0","versionType":"Packagist"},{"status":"affected","version":"v3.0.0","versionType":"Packagist"},{"status":"affected","version":"v3.0.0-BETA1","versionType":"Packagist"},{"status":"affected","version":"v3.0.1","versionType":"Packagist"},{"status":"affected","version":"v3.0.2","versionType":"Packagist"},{"status":"affected","version":"v3.0.3","versionType":"Packagist"},{"status":"affected","version":"v3.0.4","versionType":"Packagist"},{"status":"affected","version":"v3.0.5","versionType":"Packagist"},{"status":"affected","version":"v3.1.0","versionType":"Packagist"},{"status":"affected","version":"v3.1.1","versionType":"Packagist"},{"status":"affected","version":"v3.10.0","versionType":"Packagist"},{"status":"affected","version":"v3.10.1","versionType":"Packagist"},{"status":"affected","version":"v3.10.2","versionType":"Packagist"},{"status":"affected","version":"v3.10.3","versionType":"Packagist"},{"status":"affected","version":"v3.11.0","versionType":"Packagist"},{"status":"affected","version":"v3.11.1","versionType":"Packagist"},{"status":"affected","version":"v3.11.2","versionType":"Packagist"},{"status":"affected","version":"v3.11.3","versionType":"Packagist"},{"status":"affected","version":"v3.12.0","versionType":"Packagist"},{"status":"affected","version":"v3.13.0","versionType":"Packagist"},{"status":"affected","version":"v3.14.0","versionType":"Packagist"},{"status":"affected","version":"v3.14.1","versionType":"Packagist"},{"status":"affected","version":"v3.14.2","versionType":"Packagist"},{"status":"affected","version":"v3.15.0","versionType":"Packagist"},{"status":"affected","version":"v3.16.0","versionType":"Packagist"},{"status":"affected","version":"v3.17.0","versionType":"Packagist"},{"status":"affected","version":"v3.17.1","versionType":"Packagist"},{"status":"affected","version":"v3.18.0","versionType":"Packagist"},{"status":"affected","version":"v3.19.0","versionType":"Packagist"},{"status":"affected","version":"v3.2.1","versionType":"Packagist"},{"status":"affected","version":"v3.20.0","versionType":"Packagist"},{"status":"affected","version":"v3.21.0","versionType":"Packagist"},{"status":"affected","version":"v3.21.1","versionType":"Packagist"},{"status":"affected","version":"v3.22.0","versionType":"Packagist"},{"status":"affected","version":"v3.22.1","versionType":"Packagist"},{"status":"affected","version":"v3.22.2","versionType":"Packagist"},{"status":"affected","version":"v3.23.0","versionType":"Packagist"},{"status":"affected","version":"v3.24.0","versionType":"Packagist"},{"status":"affected","version":"v3.25.0","versionType":"Packagist"},{"status":"affected","version":"v3.3.0","versionType":"Packagist"},{"status":"affected","version":"v3.3.1","versionType":"Packagist"},{"status":"affected","version":"v3.3.10","versionType":"Packagist"},{"status":"affected","version":"v3.3.2","versionType":"Packagist"},{"status":"affected","version":"v3.3.3","versionType":"Packagist"},{"status":"affected","version":"v3.3.4","versionType":"Packagist"},{"status":"affected","version":"v3.3.5","versionType":"Packagist"},{"status":"affected","version":"v3.3.6","versionType":"Packagist"},{"status":"affected","version":"v3.3.7","versionType":"Packagist"},{"status":"affected","version":"v3.3.8","versionType":"Packagist"},{"status":"affected","version":"v3.3.9","versionType":"Packagist"},{"status":"affected","version":"v3.4.0","versionType":"Packagist"},{"status":"affected","version":"v3.4.1","versionType":"Packagist"},{"status":"affected","version":"v3.4.2","versionType":"Packagist"},{"status":"affected","version":"v3.4.3","versionType":"Packagist"},{"status":"affected","version":"v3.5.0","versionType":"Packagist"},{"status":"affected","version":"v3.5.1","versionType":"Packagist"},{"status":"affected","version":"v3.6.0","versionType":"Packagist"},{"status":"affected","version":"v3.6.1","versionType":"Packagist"},{"status":"affected","version":"v3.7.0","versionType":"Packagist"},{"status":"affected","version":"v3.7.1","versionType":"Packagist"},{"status":"affected","version":"v3.8.0","versionType":"Packagist"},{"status":"affected","version":"v3.9.0","versionType":"Packagist"},{"status":"affected","version":"v3.9.1","versionType":"Packagist"},{"status":"affected","version":"v3.9.2","versionType":"Packagist"},{"status":"affected","version":"v3.9.3","versionType":"Packagist"},{"events":[{"introduced":"1.15.1"},{"fixed":"3.26.0"}],"status":"unknown","version":"1.15.1","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-46633","cwes":["CWE-94"],"description":"Twig is a template language for PHP. Starting in 1.15.1 and prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.","epss":{"date":"2026-11-03","percentile":0.5276,"score":0.00688},"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793751305269,"publishedAt":1784063664916,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-7p85-w9px-jpjp"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/twigphp/Twig/commit/679447fa29083043665482ccf7d64372472621b8"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/twigphp/Twig/commit/a2c6db7ea7d2c90923e6708019ec1442526d1c30"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/twigphp/Twig/commit/e9ff55f6910832428e48a35b2e0748189ad49ae3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://gist.github.com/vladko312/d61b950f168c791db4786b83dc7a81e6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46633.yaml"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/twigphp/Twig/releases/tag/v3.26.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://symfony.com/cve-2026-46633"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-7p85-w9px-jpjp"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp"}],"remediation":[{"kind":"fix","source":"OSV GHSA-7p85-w9px-jpjp","text":"twig/twig (Packagist): OSV reports a fixed version 3.26.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-7p85-w9px-jpjp"}],"revision":"cd8d445ca068be226d26f10031131943e7b8523b9cd359728ffecd6a9d720d2b","sources":[{"modifiedAt":1793750489155,"name":"CNA: GitHub_M","retrievedAt":1793754663905,"url":"https://www.cve.org/CVERecord?id=CVE-2026-46633"},{"modifiedAt":1793751305269,"name":"OSV / GitHub Security Advisories","retrievedAt":1793754664828,"url":"https://osv.dev/vulnerability/GHSA-7p85-w9px-jpjp"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793754668464,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-46633"}],"ssvc":{"assessedAt":1784073600000,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Twig: PHP code injection via `{% use %}` template name","updatedAt":1793754668464}