CVE-2026-47730

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Published Jul 14, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Description

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

Analysis

Technical impact

Twig, used for PHP templating, includes a profiler that outputs profiling information to HTML. Between versions 3.0.0 and 3.26.0, the HtmlDumper component wrote the template name and profiler name directly into the HTML without escaping. An attacker who can influence these names can inject arbitrary HTML or JavaScript, causing the browser that displays the profiler dump to execute malicious code. The flaw is mitigated by upgrading to 3.26.0 or newer, which properly escapes these values. The issue was fixed in Twig version 3.26.0.

Affected Systems

All Twig installations from version 3.0.0 up to and excluding 3.26.0 are affected. The flaw resides in the Twig:Twig product maintained by twigphp.

Risk and Exploitability

The CVSS score of 5.1 indicates a medium severity, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can trigger the rendering of a profiler dump containing a manipulated template or profile name, which is typically confined to environments where the Twig profiler is enabled and accessible by privileged users. Consequently, the attack vector is constrained, but the threat remains relevant for any exposed debug interfaces.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

twigphp

Twig

affected

Version	Status	Constraints
`>= 3.0.0, < 3.26.0`	affected	—

Configuration 1 [-]

cpe:2.3:a:symfony:twig:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Twigphp

Twig

Version	Status	Scheme	Platform
`[3.0.0,3.26.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Twig update to version 3.26.0 or later, which removes the unescaped output bug
In production environments, disable the Twig profiler or restrict its access to trusted administrative users to prevent accidental exposure
If an immediate upgrade is not possible, configure Twig to escape profiler output or replace HtmlDumper with a safer dumper implementation, ensuring that any user‑supplied names are properly escaped

Generated by OpenCVE AI on July 31, 2026 at 04:35 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6311-1	php-twig security update
Debian DSA	DSA-6320-1	php-twig security update
Github GHSA	GHSA-2g2g-8p8h-fgwm	Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.295% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/twigphp/Twig/commit/a5f6e8793e603ef34fa86aed2a72f9fbe0b43745
https://github.com/twigphp/Twig/releases/tag/v3.26.0
https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm

History

Jul 21, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 15, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Twigphp Twigphp twig
Vendors & Products		Twigphp Twigphp twig

Jul 14, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
Title		Twig: XSS in profiler HtmlDumper via unescaped template and profile names
Weaknesses		CWE-79
References		https://github.com/twigphp/Twig/commit/a5f6e8793e603ef34fa86aed2a72f9fbe0b43745 https://github.com/twigphp/Twig/releases/tag/v3.26.0 https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm
Metrics		cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}`