Vulnerability Description
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
CVSS Score
4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Related Weaknesses (CWE)
References
- https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
- https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr
FAQ
What is CVE-2025-24374?
CVE-2025-24374 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
How severe is CVE-2025-24374?
CVE-2025-24374 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-24374?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.