Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-47730

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

twigphp Twig

  • >= 3.0.0, < 3.26.0affected

References