Executive brief
Twig, a popular template engine for PHP applications, contains a security flaw in its profiling tool used by developers. If an application allows users to influence template or profile names, an attacker could inject malicious scripts that execute in the browser of a developer or administrator viewing the profiler output. This could lead to unauthorized actions being performed in the context of the user's session.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Twig Profiler's HtmlDumper component. The root cause is the failure to neutralize output from Profile::getTemplate() and Profile::getName() before interpolating them into HTML spans within the formatTemplate method. If an application uses a loader (such as ArrayLoader or a database-backed loader) where template identifiers are user-controllable, an attacker can inject arbitrary HTML/JavaScript. The exploit occurs when a user views the generated profiler dump in a browser. This is fixed in version 3.26.0 by applying htmlspecialchars() to the affected profile data.
Affected products
- twigphp Twig >= 3.0.0, < 3.26.0
Timeline
- 2026-05-20: patched: Fixed in version 3.26.0
- 2026-05-20: advisory: GitHub Security Advisory GHSA-2g2g-8p8h-fgwm published
- 2026-07-14: disclosed: CVE-2026-47730 published to NVD