CVE-2025-24374

4.3 mediumEPSS 0.3%

Medium (4.3). EPSS 0.3% chance of exploitation in the next 30 days.

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-74
Published: 2025-01-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr

Check your stack JSON