Medium severity · published Jan 29, 2025
CVE-2025-24374
Twig fixes a security issue where escaping was missing when using null coalesce operator (??)
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twig · twigphp
>= 3.16.0, < 3.19.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24374
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24374
github.com
https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
github.com
https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
More from Twig
9.9
CVE-2026-24425
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
9.8
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
9.8
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
9.1
CVE-2026-48807
Twig: Sandbox `__toString()` policy bypass via `Traversable` in `join` and `replace` filters
9.1
CVE-2026-48806
Twig: Sandbox `__toString()` policy bypass via dynamic mapping keys