UBUNTU-CVE-2026-46634

Twig is a template language for PHP. From 3.9.0 until 3.26.0, templatefromstring compiles an inner template under a synthesized stringtemplate name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call templatefromstring and include to render ...

CVE-2026-46634 vulnerabilities

Vulnerabilities for packages: drupal...

Linux Distros Unpatched Vulnerability : CVE-2026-46634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. From 3.9.0 until 3.26.0, templatefromstring compiles an inner template under a synthesized stringtemplate name that can fal...

CVE-2026-46634

creationtimestamp| type| source ---|---|--- 2026-05-20 10:30:46+00:00| seen| https://bsky.app/profile/symfony.com/post/3mmbp6ssob226 2026-07-15 09:34:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqog546kbn2u 2026-07-17 15:18:04+00:00| seen|...

`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

More info at https://symfony.com/cve-2026-46634...