CVE-2026-46627·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.39% — higher than 31% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Update PHP and the Twig templating engine to version 3.26.0 or later to address resource exhaustion vulnerabilities in the sandbox environment. Organizations using untrusted or user-supplied Twig templates should prioritize this update and consider implementing additional resource limits at the application or system level. While the sandbox itself cannot fully prevent CPU, memory, or execution time abuse, the patched version includes critical security documentation and improvements to mitigate these risks.

sudo dnf update php

How to check if you are affected

1. Step 1: Check the installed PHP version and Twig version by running `php -v` and `composer show symfony/twig-bundle` or `grep -r 'Twig' /path/to/vendor/`
2. Step 2: Identify if your application processes untrusted templates by searching code for `Twig_Environment` or `twig.sandbox` configuration in framework files
3. Step 3: Review application logs and system resource monitoring (memory, CPU) for anomalous spikes during template processing, particularly when handling user-uploaded or dynamically-loaded templates
4. Step 4: Verify the Twig version is 3.26.0 or higher by running `php -r "echo (new ReflectionClass('Twig\Environment'))->getFileName();"` and checking vendor directory timestamps post-update

FAQ

Related PHP CVEs

References

• https://github.com/twigphp/Twig/commit/6bfa285e2f98651adb7aa480bf83a741d154f09f
• https://github.com/twigphp/Twig/releases/tag/v3.26.0
• https://github.com/twigphp/Twig/security/advisories/GHSA-923g-j88x-j34q