CVE-2026-46636: 
PHP vulnerability analysis and mitigation

CVE-2026-46636 is a sandbox security feature bypass vulnerability in Twig, the PHP template engine, caused by SecurityPolicy::checkMethodAllowed() unconditionally whitelisting all method calls on instances of Twig\Markup. Because Twig\Markup is not declared final, subclasses inherit this bypass, inadvertently exposing every public method of any Markup-derived class passed into a sandboxed template — regardless of the configured allowedMethods list. It affects Twig versions 1.0.0 through before 3.27.0 and was patched in version 3.27.0, released May 27, 2026. The vulnerability carries a CVSS v4.0 base score of 8.7 (High) (Symfony Advisory, Debian Tracker).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The vulnerability has two related but distinct dimensions: first, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on Twig\Markup instances and their subclasses; second, the per-template filter, tag, and function allow-list security check is compiled at template construction time and cached on the Environment object — meaning that when sandbox state changes between renders (via enableSandbox()/disableSandbox(), setSecurityPolicy(), SourcePolicyInterface decisions, or pre-instantiation of templates), the cached security verdict remains stale and does not reflect the updated policy. Long-lived worker environments (e.g., FrankenPHP, RoadRunner, Symfony Messenger consumers, or FPM with hot autoloading) that share a single Environment across sandboxed and non-sandboxed renders are most vulnerable, as method, property, and __toString allow-lists continue to be enforced at runtime and are unaffected (Symfony Advisory, Twig v3.27.0 Release).

Successful exploitation allows a template author to bypass the Twig sandbox's SecurityPolicy allow-lists for filters, tags, and functions, as well as invoke arbitrary public methods on Markup-derived objects passed into sandboxed templates. This primarily impacts confidentiality (CVSS v4.0 VC:H), as attackers could access sensitive data or invoke methods that expose internal application state. Integrity and availability impacts are rated as none in the CVSS scoring, though the practical risk depends on what methods are exposed by the application's Markup subclasses (Symfony Advisory, Debian Tracker).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC data (exploitation: none) and Feedly threat intelligence. The vulnerability is rated automatable (no user interaction or privileges required, network-accessible), which increases its theoretical risk in exposed deployments. The EPSS score is approximately 0.358%, indicating a low but non-negligible probability of exploitation in the near term. CVE-2026-46636 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Symfony Advisory).

The primary remediation is to upgrade Twig to version 3.27.0 or later, which patches the sandbox bypass by fixing the cached security verdict issue and the Twig\Markup method whitelisting behavior (Twig v3.27.0 Release). Debian Trixie users should update to php-twig package version 3.27.0-0+deb13u1 (via DSA-6311-1); Debian Bookworm (stable) is noted as vulnerable but the fix was deemed too intrusive to backport (Debian Tracker). As a workaround for environments using long-lived workers, create separate Environment instances for each sandboxed versus non-sandboxed rendering context rather than reusing a shared Environment with changing sandbox states (Symfony Advisory).

The vulnerability was discussed on the r/symfony subreddit shortly after disclosure, and Symfony's official blog published the advisory. A Mastodon post by security researcher @hugovalters also noted the issue. Linux compatibility news outlets covered it as part of a broader Debian security update batch addressing multiple CVEs in php-twig (Reddit, Linux Compatible).