Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2025-24374

Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.

VectorNETWORK

PublishedJan 29, 2025, 16:15

Published Bysecurity-advisories@github.com

Base Score

Score4.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

twig/twig(Packagist)3.16.03.19.0N/A

References

https://github.com/twigphp/Twig/commit/38576b12f05df3cc871bf68f39ccb46b418334a3
https://github.com/twigphp/Twig/security/advisories/GHSA-3xg3-cgvq-2xwr

Weakness Type

CWE-74

CVSS Metrics

Base Score

4.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK