CVE-2025-24374
Fixed in a distro release EPSS <1%CVSS 4.3
Twig is a template language for PHP. When using the ?? operator, output escaping was missing for the expression on the left side of the operator. This vulnerability is fixed in 3.19.0.
Products: twigphp Twig
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | twig/twig | 3.19.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | php-twig | no fix |
| Debian 13 | php-twig | 3.19.0-1~bootstrap |
| Debian 14 | php-twig | 3.19.0-1~bootstrap |
| Ubuntu Pro 16.04 LTS | twig | no fix |
| Ubuntu Pro 18.04 LTS | twig | no fix |