twig vulnerabilities and fixes

Recent CVEs affecting twig, with upgrade or downgrade steps. 16 tracked.

twig has 16 tracked vulnerabilities, 5 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-07-14. Highest priority: CVE-2026-46633 (score 52/100).

• CVE-2026-46633 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-46634 CRITICAL 9.8 UPGRADE Twig is a template language for PHP
• CVE-2026-48805 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-48806 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-48807 CRITICAL 9.1 UPGRADE Twig is a template language for PHP
• CVE-2026-46640 HIGH 8.8 UPGRADE Twig is a template language for PHP
• CVE-2026-49981 HIGH 8.2 UPGRADE Twig is a template language for PHP
• CVE-2026-48808 HIGH 7.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46638 HIGH 8.1 UPGRADE Twig is a template language for PHP
• CVE-2026-46627 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46629 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46639 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-47732 MEDIUM 6.5 UPGRADE Twig is a template language for PHP
• CVE-2026-46628 MEDIUM 5.4 UPGRADE Twig is a template language for PHP
• CVE-2026-47730 MEDIUM 5.4 UPGRADE Twig is a template language for PHP
• CVE-2026-46635 MEDIUM 4.3 UPGRADE Twig is a template language for PHP

FAQ

How do I fix twig vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is twig being exploited right now?

None of the tracked twig CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which twig CVE should I patch first?

CVE-2026-46633 currently ranks highest (52/100): Twig is a template language for PHP.

← Back to latest CVEs