Is there a patch available for CVE-2026-47730?

Yes, a patch is available for CVE-2026-47730. Update the affected software to the latest version immediately.

Twig CVE-2026-47730

Q: What is the CVSS score of CVE-2026-47730?

CVE-2026-47730 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-05 https://github.com/twigphp/Twig

GHSA-2g2g-8p8h-fgwm

PHP XSS

5.1

CVSS 4.0 · Vendor: https://github.com/twigphp/Twig

Severity by source

Vendor (https://github.com/twigphp/Twig) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/twigphp/Twig) · only source for this CVE.

CVSS VectorVendor: https://github.com/twigphp/Twig

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 22:22 NVD

5.1 (MEDIUM)

Source Code Evidence Fetched

Jun 05, 2026 - 22:17 vuln.today

Analysis Generated

Jun 05, 2026 - 22:17 vuln.today

DescriptionCVE.org

Description

Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() straight into its HTML output without escaping:

php

protected function formatTemplate(Profile $profile, $prefix): string
{
    return \sprintf('%s└ <span style="background-color: %s">%s</span>', $prefix, self::$colors['template'], $profile->getTemplate());
}

The template name comes from the loader (the array key for ArrayLoader, a row id for a database-backed loader, etc.). When that name is attacker-controlled, the profiler dump emits arbitrary HTML, and any browser that renders it executes the injected markup. This is an output-encoding bug in profiler/debug tooling, not a sandbox escape.

Resolution

HtmlDumper now runs both Profile::getTemplate() and Profile::getName() through htmlspecialchars() before inserting them into the HTML output.

Credits

Twig would like to thank El Kharoubi Iosif for reporting the issue and Nicolas Grekas for fixing it.

AnalysisAI

Cross-site scripting in Twig's profiler HtmlDumper component (twig/twig >= 3.0.0, < 3.26.0) allows an attacker who can control template names - via an ArrayLoader key, a database-backed loader row ID, or similar - to inject arbitrary HTML that executes in any browser rendering the profiler output. The root cause is a missing htmlspecialchars() call in HtmlDumper::formatTemplate() and related methods before writing Profile::getTemplate() and Profile::getName() into the HTML response. No public exploit or CISA KEV listing has been identified at time of analysis, but the vendor confirmed the issue and shipped a fix in v3.26.0 as part of a coordinated batch of security releases.

Technical ContextAI

Twig (composer package twig/twig) is a widely deployed PHP templating engine. Its optional profiler subsystem includes HtmlDumper, a debug utility that renders a tree of template execution timing data as HTML. The affected code path is HtmlDumper::formatTemplate(), which uses sprintf() to embed profile->getTemplate() directly into an HTML <span> element without first passing the value through htmlspecialchars(). CWE-79 (Improper Neutralization of Input During Web Page Generation) precisely describes this root cause: user-supplied or otherwise externally influenced data is inserted into an HTML context without output encoding. The attacker-controlled input surface includes any mechanism that influences the template name as seen by the Twig loader - notably ArrayLoader (where the template name is the array key, potentially sourced from a database or user input) and custom database-backed loaders where the name field may be a mutable row attribute. This is explicitly classified by the vendor as a profiler/debug tooling output-encoding bug, not a sandbox escape.

RemediationAI

Upgrade twig/twig to version 3.26.0 or later via Composer (composer update twig/twig). The fix - confirmed in the GHSA advisory and the v3.26.0 release notes - applies htmlspecialchars() to both Profile::getTemplate() and Profile::getName() before HTML insertion. Release details are available at https://github.com/twigphp/Twig/releases/tag/v3.26.0. If an immediate upgrade is not feasible, the most targeted compensating control is to disable the Twig profiler entirely in any environment where its HTML output could be viewed by users other than fully trusted developers, or where template names are sourced from attacker-influenced data stores. In Symfony, this means setting twig.profiler to false or ensuring the profiler toolbar is inaccessible outside local development. Restricting access to the profiler endpoint (e.g., firewall rules to localhost or authenticated admin users only) reduces but does not eliminate risk if those users themselves are adversaries. Note that disabling the profiler may reduce debug visibility in staging environments.