{"id":"CVE-2025-24374","aliases":["DEBIAN-CVE-2025-24374","EUVD-2025-0128","GHSA-3xg3-cgvq-2xwr","UBUNTU-CVE-2025-24374"],"status":"published","title":"Twig fixes a security issue where escaping was missing when using null coalesce operator (??)","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00298,"percentile":0.22647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2025-01-29T15:22:34Z","modified":"2026-10-28T02:30:37Z","fixes":[{"ecosystem":"Packagist","package":"twig/twig","fixed_in":["3.19.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"php-twig","fixed_in":["3.19.0-1~bootstrap"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"php-twig","fixed_in":["3.19.0-1~bootstrap"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"3.19.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.1-1","3.10.3-1","3.11.0-1","3.13.0-1","3.14.0-1","3.14.0-2","3.14.0-3","3.14.0-4","3.14.2-1","3.14.2-2","3.14.2-3","3.15.0-1","3.15.0-2","3.17.1-1","3.17.1-2","3.18.0-1","3.18.0-2","3.18.0-4","3.18.0-5","3.18.0-6","3.18.0-7","3.19.0-1","3.19.0-1~bootstrap","3.20.0-1","3.20.0-1~bootstrap","3.20.0-2","3.21.1-1","3.21.1-2","3.21.1-3","3.22.0-1","3.22.0-2","3.22.1-1","3.22.1-2","3.22.1-3","3.22.2-1","3.22.2-2","3.23.0-1","3.23.0-2","3.24.0-1","3.26.0-1","3.27.0-1","3.27.1-1","3.28.0-1","3.5.1-1","3.5.1-1+deb12u1","3.5.1-1+deb12u2","3.5.1-1+deb12u3","3.6.0-1","3.6.1-1","3.7.0-1","3.7.1-1","3.7.1-2","3.7.1-3","3.8.0-1","3.8.0-2","3.8.0-3","3.8.0-4","3.9.3-1","4.0.0~alpha1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-1~bootstrap"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"php-twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-1~bootstrap"}]}]},{"source":"osv","ecosystem":"Packagist","package":"twig/twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"3.19.0"}]}],"versions":["v3.16.0","v3.17.0","v3.17.1","v3.18.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.0-1","1.23.1-1ubuntu1","1.23.1-1ubuntu4","1.23.1-1ubuntu4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"twig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.0-2ubuntu1","2.4.4-2ubuntu1","2.4.6-1","2.4.6-1ubuntu0.1~esm1"]}],"products":[{"vendor":"twigphp","product":"twig"}],"references":[{"url":"https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24374","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/twig/twig/CVE-2025-24374.yaml","tags":["web"]},{"url":"https://symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3xg3-cgvq-2xwr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24374.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-24374","tags":["advisory"]},{"url":"https://github.com/twigphp/Twig","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-24374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24374","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-24374","title":"Twig fixes a security issue where escaping was missing when using null coalesce operator (??)","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T15:22:34.012Z","modified":"2025-01-29T15:44:49.358Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:32:44.11109Z"}],"euvd":[{"id":"EUVD-2025-0128","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T15:22:34Z","modified":"2025-01-29T15:44:49Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:09.89712Z"}],"ghsa":[{"id":"GHSA-3xg3-cgvq-2xwr","title":"Twig security issue where escaping was missing when using null coalesce operator","description":"When using the `??` operator, output escaping was missing for the expression on the left side of the operator.\n","status":"published","published":"2025-01-29T18:41:43Z","modified":"2025-01-30T15:33:26Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2025-24374","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T16:15:44.09Z","modified":"2026-06-17T08:58:55.593Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:10:49.841519Z"}],"osv":[{"id":"CVE-2025-24374","title":"Twig fixes a security issue where escaping was missing when using null coalesce operator (??)","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T15:22:34.012Z","modified":"2026-10-28T02:30:37.407711744Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:47.009967Z"},{"id":"DEBIAN-CVE-2025-24374","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T16:15:44.09Z","modified":"2026-09-01T20:05:44.726779794Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-3xg3-cgvq-2xwr","title":"Twig security issue where escaping was missing when using null coalesce operator","description":"When using the `??` operator, output escaping was missing for the expression on the left side of the operator.\n","status":"published","published":"2025-01-29T18:41:43Z","modified":"2025-01-30T15:36:48.022757Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2025-24374","description":"Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.","status":"published","published":"2025-01-29T16:15:00Z","modified":"2025-09-08T17:08:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"}]}}