Twig security issue where escaping was missing when using null coalesce operator
When using the `??` operator, output escaping was missing for the expression on the left side of the operator.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24374US | — | — | ||
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.1… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yamlWEB
- https://github.com/twigphp/TwigPACKAGE
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3WEB
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwrWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374ADVISORY
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operatorWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan