CVE-2020-5226

CVE-2020-5226 affects SimpleSAMLphp prior to 1.18.4. The vulnerability stems from www/errorreport.php where error reports are sent via the SimpleSAML\Utils\EMail wrapper. Starting with 1.18.0, Twig-based email templates were introduced; Twig escapes variables, but the older plain PHP template did...