CVE-2026-46638

Summary

Twig: `{% sandbox %}{% include %}` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411)

Severity

medium

Also known as

GHSA-7fxw-r6jv-74c8

Published

2026-05-21

References

• https://github.com/twigphp/Twig/security/advisories/GHSA-7fxw-r6jv-74c8
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-46638.yaml
• https://github.com/advisories/GHSA-6j75-5wfj-gh66

Related advisories

• CVE-2026-46633 — critical · Packagist/twig/twig
• CVE-2026-47732 — high · Packagist/twig/twig
• CVE-2026-24425 — high · Packagist/twig/twig
• CVE-2026-46640 — high · Packagist/twig/twig
• CVE-2026-46639 — high · Packagist/twig/twig
• CVE-2026-46634 — medium · Packagist/twig/twig
• CVE-2025-24374 — medium · Packagist/twig/twig
• CVE-2024-45411 — medium · Packagist/twig/twig

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity