CVE-2026-46638

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description An issue exists where the {% sandbox %}{% include ... %}{% endsandbox %} tag path fails to re-invoke the checkSecurity() function. If a template is loaded outside a sandbox within the same Environment instance, its security check runs while isSandboxed() is false. Consequently, when that same template is later included within a sandbox, the allowlist for tags, filters, and functions enforced by SecurityPolicy::checkSecurity() is not applied. This allows an attacker who can author the included template to access all registered filters, functions, and tags in the environment, bypassing the sandbox policy.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.