Packagist/twig/twig CVE-2026-47730: medium 5.4, EPSS 0.29%

Twig: XSS in profiler HtmlDumper via unescaped template and profile names

Action: Upgrade twig/twig to 3.26.0 or later.

composer require twig/twig:3.26.0

Affected

Fixed versions

Sources

• osv: GHSA-2g2g-8p8h-fgwm
• nvd: CVE-2026-47730
• https://github.com/twigphp/Twig/security/advisories/GHSA-2g2g-8p8h-fgwm
• https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2026-47730.yaml
• https://github.com/twigphp/Twig
• https://github.com/twigphp/Twig/releases/tag/v3.26.0
• https://symfony.com/cve-2026-47730

CVE-2026-47730 · published 2026-06-05T21:46:26Z · modified 2026-09-10T03:51:07.469938305Z · JSON