CVE-2025-24374
1 advisory.
Packagist/twig/twig CVE-2025-24374: medium 4.3, EPSS 0.29%
Twig security issue where escaping was missing when using null coalesce operator
Action: Upgrade twig/twig to 3.19.0 or later.
composer require twig/twig:3.19.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.16.0 | 3.19.0 | - |
Fixed versions
| 3.19.0 |
Sources
- osv: GHSA-3xg3-cgvq-2xwr
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml
- https://github.com/twigphp/Twig
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator
CVE-2025-24374 · published · modified · JSON