PT-2026-45157 · Twig · Twig

Published 2026-05-21 · Updated 2026-06-05 · CVE-2026-47730

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Twig (affected versions not specified)

Description The TwigProfilerDumperHtmlDumper component fails to escape the output of Profile::getTemplate() and Profile::getName() when writing to HTML. If an attacker can control the template name—which may originate from an ArrayLoader array key or a database-backed loader row ID—they can inject arbitrary HTML. This results in the browser executing the injected markup when rendering the profiler dump. This is an output-encoding issue within the profiler and debug tooling.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47730

GHSA-2G2G-8P8H-FGWM

Affected Products

Twig

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47730.yaml · Exploit
• https://cve.org/CVERecord?id=CVE-2026-47730 · Security Note
• https://ubuntu.com/security/CVE-2026-47730 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-47730 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47730 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2g2g-8p8h-fgwm · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47730 · Vendor Advisory
• https://github.com/twigphp/Twig/releases/tag/v3.26.0 · Note
• https://github.com/twigphp/Twig · Note
• https://symfony.com/cve-2026-47730 · Note
• https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm · Note
• https://symfony.com/blog/cve-2026-47730-xss-in-profiler-htmldumper-via-unescaped-template-and-profile-names · Note