CyberRota Analysis
AI-GeneratedThe Twig template language for PHP versions 3.0.0 to 3.26.0 is vulnerable due to the HtmlDumper writing unescaped template and profile names into HTML output, which can lead to arbitrary HTML injection by attackers. This vulnerability poses a risk of cross-site scripting (XSS) attacks when the profiler dump is rendered in a browser. Developers and organizations using affected versions of Twig should prioritize updating to version 3.26.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)