CVE-2026-47730

Analyzed Analyzed - Analysis Complete

HTML Injection in Twig Profiler Dumper via Unescaped Template Names

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47730

Affected Vendors & Products

Vendor	Product	Version / Range
symfony	twig	From 3.0.0 (inc) to 3.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Twig is a PHP template language. Between versions 3.0.0 and 3.26.0, the HtmlDumper component writes unescaped Profile::getTemplate() and Profile::getName() values into HTML output. This allows attackers to inject arbitrary HTML by controlling template or profile names, which executes when the profiler dump is viewed in a browser.

Detection Guidance

This vulnerability can be detected by checking the installed version of Twig. If you are using a version between 3.0.0 and 3.26.0, your system is vulnerable. Run the command 'composer show twig/twig' to check the installed version.

Impact Analysis

An attacker could craft malicious template or profile names to inject HTML or JavaScript into the profiler output. If viewed in a browser, this could lead to phishing attacks, session hijacking, or defacement of the profiler interface.

Compliance Impact

This vulnerability could expose sensitive data or enable cross-site scripting (XSS) attacks, potentially violating GDPR (data protection) or HIPAA (healthcare data privacy) requirements for secure data handling and user protection.

Mitigation Strategies

Upgrade Twig to version 3.26.0 or later immediately. Use the command 'composer require twig/twig:^3.26.0' to update. Additionally, review any custom templates or profile names that may contain user-controlled input to prevent potential HTML injection.

Hi! I’m here to help you understand CVE-2026-47730. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70