Twig security issue where escaping was missing when using null coalesce operator
When using the `??` operator, output escaping was missing for the expression on the left side of the operator.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24374US | — | — | ||
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.1… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yamlWEB
- https://github.com/twigphp/TwigPACKAGE
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3WEB
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwrWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-24374ADVISORY
- https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operatorWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan