Bug 2500745 (CVE-2026-46640)

Summary: CVE-2026-46640 twig/twig: Twig: Arbitrary code execution via improper handling of dynamic attributes
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Twig, a template language for PHP. An attacker with low privileges could exploit a vulnerability in the `_self.(<string>)` and `import-alias` dynamic attribute syntax. By concatenating a malicious string into a `MacroReferenceExpression` name without proper validation, the attacker can cause raw PHP code to be embedded and executed within the generated template. This could lead to arbitrary code execution on the server.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-14 22:04:13 UTC 
Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.