SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-46636

HIGH · CVSS 8.7 EPSS 0.36% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-04 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

Applications using Twig versions prior to 3.27.0 are vulnerable due to a flaw in the SecurityPolicy::checkMethodAllowed() function, which allows unrestricted access to public methods of subclasses derived from Twig\Markup. This can lead to unauthorized method execution within sandboxed templates, potentially compromising application security. Developers and organizations utilizing affected Twig versions should prioritize upgrading to version 3.27.0 or later to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-46636
Severity
HIGH
CVSS
8.7
EPSS
0.36%

Original NVD Description

Twig is a template language for PHP. From version 1.0.0 to before version 3.27.0, SecurityPolicy::checkMethodAllowed() unconditionally whitelists all method calls on instances of Twig\Markup. Twig\Markup is not final, so subclasses inherit the bypass. An application that passes an object of a Markup-derived class into a sandboxed template (typically to mark a chunk of HTML as safe) inadvertently exposes every public method of that subclass to template authors, regardless of the configured allowedMethods list. This issue has been patched in version 3.27.0.