Most recent entries from all

EUVD-2026-339156

2026-10-02T22:05:07.178551+00:00

EUVD-2026-339156

fkie_cve-2026-47730

2026-10-02T22:05:07.178579+00:00

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.

GHSA-2g2g-8p8h-fgwm — Twig: XSS in profiler HtmlDumper via unescaped template and profile names

2026-10-02T22:05:07.178609+00:00

Affected: Packagist: twig/twig

### Description

`Twig\Profiler\Dumper\HtmlDumper` writes `Profile::getTemplate()` and `Profile::getName()` straight into its HTML output without escaping:

```php protected function formatTemplate(Profile $profile, $prefix): string { return \sprintf('%s└ %s', $prefix, self::$colors['template'], $profile->getTemplate()); } ```

The template name comes from the loader (the array key for `ArrayLoader`, a row id for a database-backed loader, etc.). When that name is attacker-controlled, the profiler dump emits arbitrary HTML, and any browser that renders it executes the injected markup. This is an output-encoding bug in profiler/debug tooling, not a sandbox escape.

### Resolution

`HtmlDumper` now runs both `Profile::getTemplate()` and `Profile::getName()` through `htmlspecialchars()` before inserting them into the HTML output.

### Credits

Twig would like to thank El Kharoubi Iosif for reporting the issue and Nicolas Grekas for fixing it.

UBUNTU-CVE-2026-47730

2026-10-02T22:05:07.178649+00:00

Affected: Ubuntu:Pro:20.04:LTS: php-twig, Ubuntu:Pro:22.04:LTS: php-twig, Ubuntu:Pro:24.04:LTS: php-twig, Ubuntu:25.10: php-twig, Ubuntu:Pro:26.04:LTS: php-twig