Twig, used for PHP templating, includes a profiler that outputs profiling information to HTML. Between versions 3.0.0 and 3.26.0, the HtmlDumper component wrote the template name and profiler name directly into the HTML without escaping. An attacker who can influence these names can inject arbitrary HTML or JavaScript, causing the browser that displays the profiler dump to execute malicious code. The flaw is mitigated by upgrading to 3.26.0 or newer, which properly escapes these values. The issue was fixed in Twig version 3.26.0.

All Twig installations from version 3.0.0 up to and excluding 3.26.0 are affected. The flaw resides in the Twig:Twig product maintained by twigphp.

The CVSS score of 5.1 indicates a medium severity, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can trigger the rendering of a profiler dump containing a manipulated template or profile name, which is typically confined to environments where the Twig profiler is enabled and accessible by privileged users. Consequently, the attack vector is constrained, but the threat remains relevant for any exposed debug interfaces.