CVE-2026-47730
LOW SEVERITYCVSS Score & Metrics
Base Score
5.4 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability Description
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-79
Source
GitHub
Vendor
composer
Product
twig/twig
External References
- https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47730.yaml
- https://github.com/twigphp/Twig/releases/tag/v3.26.0
- https://symfony.com/cve-2026-47730
- https://github.com/advisories/GHSA-2g2g-8p8h-fgwm
Discussion (0)
Add Comment
No comments yet. Be the first!