CVE-2026-46634

Executive Summary

CVE-2026-46634 is a security bypass vulnerability in the Twig template engine for PHP, affecting versions 3.9.0 through 3.26.0. The flaw resides in the template_from_string() function, which compiles an inner template under a synthesized name (__string_template__<hash>). This synthesized name can fall outside the scope of a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This effectively bypasses the sandbox, potentially allowing an attacker to execute arbitrary template code or access restricted resources.

Supply Chain & Package Security

Twig is a widely used PHP package, distributed via Composer (Packagist). The vulnerability affects any application using the affected versions of the twig/twig package. Organizations should audit their composer.json or composer.lock files for the vulnerable version range and update immediately. The package is a direct dependency in many PHP frameworks (e.g., Symfony, Drupal, Laravel), making this a high-impact supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a sandboxed template that can call template_from_string and include.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its original scope.
• Confidentiality (C): High (H) – Potential for unauthorized access to sensitive data.
• Integrity (I): High (H) – Potential for unauthorized modification of data.
• Availability (A): None (N) – No direct impact on availability.

CVSS Score: 8.7 (High)

Threat Level: High. The vulnerability allows a sandbox bypass, which can lead to remote code execution or data exfiltration in the context of the template engine.

Deep Dive & Mechanics

The Twig sandbox is designed to restrict the functions, filters, tags, and methods that can be used within a template. The SourcePolicyInterface is a key component that decides whether a given template source is allowed to be compiled. When template_from_string() is called, it creates a new template from a string and compiles it under a synthetic name like __string_template__<hash>. The vulnerability arises because this synthetic name is not properly checked against the SourcePolicyInterface. As a result, a sandboxed template that has permission to call template_from_string and include can create and render an inner template that bypasses all sandbox restrictions.

Attack Flow:

1. An attacker gains the ability to submit or modify a Twig template (e.g., via a CMS or application feature).
2. The attacker crafts a template that calls template_from_string with a malicious string containing arbitrary Twig code.
3. The inner template is compiled under the synthetic name, which is not subject to the sandbox policy.
4. The attacker uses include to render the inner template, executing the malicious code without restrictions.

Vulnerable vs. Patched Code

Vulnerable Code (Twig < 3.26.0):

// In TemplateWrapper or similar class
public function createTemplate(string $template): TemplateWrapper
{
    $name = '__string_template__' . hash('xxh3', $template);
    // The $name is not checked against SourcePolicyInterface
    $this->env->setLoader(new ArrayLoader([$name => $template]));
    return new TemplateWrapper($this->env, $this->env->loadTemplate($name));
}

Patched Code (Twig >= 3.26.0):

// In TemplateWrapper or similar class
public function createTemplate(string $template): TemplateWrapper
{
    $name = '__string_template__' . hash('xxh3', $template);
    // Check the source against the SourcePolicyInterface
    $source = new Source($template, $name);
    $this->env->getExtension(SandboxExtension::class)->checkSource($source);
    $this->env->setLoader(new ArrayLoader([$name => $template]));
    return new TemplateWrapper($this->env, $this->env->loadTemplate($name));
}

The patch adds a call to checkSource() on the Source object, ensuring the inner template is evaluated against the sandbox policy before compilation.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A PHP application using Twig 3.9.0 to 3.26.0.
• The attacker must have the ability to submit or modify a Twig template (e.g., via a template editor, CMS, or SSTI vulnerability).

Exploitation Steps:

1. Identify a sandboxed template that allows template_from_string and include (e.g., via a whitelist).
2. Craft the following payload:

   {% set malicious = template_from_string('{{ system("id") }}') %}
   {% include malicious %}
   

3. Submit the template. The inner template will execute system("id") without sandbox restrictions.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor for unusual template compilation activity, especially templates with names starting with __string_template__.
• Look for calls to template_from_string with suspicious or obfuscated strings.
• Use the detection rules provided below.

Hunting:

• Search logs for errors or warnings related to SourcePolicyInterface or SandboxExtension.
• Audit all templates that use template_from_string and include together.

Indicators of Compromise (IOCs)

• File-based: Templates containing template_from_string and include in the same block.
• Network: Unusual HTTP requests to endpoints that process Twig templates (e.g., /template/edit, /api/render).
• Logs: PHP error logs showing Twig\Error\RuntimeError or Twig\Sandbox\SecurityError being suppressed.
• Process: Unexpected execution of system commands (e.g., id, whoami) from the web server user.

Detection Engineering

YARA Rule

rule CVE_2026_46634_Twig_Sandbox_Bypass {
    meta:
        description = "Detects Twig templates exploiting CVE-2026-46634 sandbox bypass"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-46634"
    strings:
        $s1 = "template_from_string(" ascii nocase
        $s2 = "include" ascii nocase
        $s3 = "__string_template__" ascii nocase
    condition:
        all of ($s1, $s2) or ($s1 and $s3)
}

Sigma Rule

title: CVE-2026-46634 Twig Sandbox Bypass via template_from_string
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2026-46634 in Twig templates
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: php
detection:
    selection:
        - 'template_from_string('
        - 'include'
    condition: selection
falsepositives:
    - Legitimate use of template_from_string with include in sandboxed environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-46634 Twig Sandbox Bypass Attempt"; flow:to_server; content:"template_from_string("; nocase; content:"include"; nocase; distance:0; within:500; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Twig to version 3.26.0 or later.
• If immediate upgrade is not possible, disable the template_from_string function in the sandbox configuration:

  $twig->addExtension(new SandboxExtension($policy, false));
  $policy->setAllowedFunctions(['template_from_string' => false]);
  

Long-term:

• Regularly update all dependencies, especially security-sensitive packages like Twig.
• Implement strict input validation and output encoding for all user-supplied template content.
• Use a Web Application Firewall (WAF) to block requests containing suspicious Twig syntax.
• Conduct regular security audits of template usage in the application.

Valters IT
Securing Digital Frontiers