CVE-2026-46640

Katalog CVE

CVSS 8.8 · High EPSS 0,64%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada symfony twig. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

16 Juli 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/twigphp/Twig/security/advisories/GHSA-45vw-wh46-2vx8 advisory vendor
• https://github.com/twigphp/Twig/commit/324fa60545694fa6abe85ded9befcb82e1066bc2 patch
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 release notes