CVE-2025-24374 MEDIUM

CVE-2025-24374: Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Vendor Twigphp

Product Twig

Weakness CWE-74

Published January 29, 2025

Last update January 29, 2025

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

Key dates

02Disclosure timeline

January 29, 2025 CVE published

January 29, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-24374 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/74.html