`template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name

More info at https://symfony.com/cve-2026-46634...