What’s Vulnerable › Vulnerabilities

CVE-2025-24374: Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-29 · updated 2026-06-17
• Weakness: CWE-74

Description

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

Affected products

• twigphp Twig: from 3.16.0, < 3.19.0

References

• https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
• https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr

Get alerted when CVE-2025-24374 or the next vulnerability affects your stack