CVE-2025-24374: 
PHP vulnerability analysis and mitigation

Twig, a template language for PHP, disclosed a security vulnerability (CVE-2025-24374) on January 29, 2025. The vulnerability stems from missing output escaping when using the ?? (null coalesce) operator for the expression on the left side of the operator. This issue has been fixed in version 3.19.0 (NVD, GitHub Advisory).

The vulnerability is classified as moderate with a CVSS v3.1 base score of 4.3 (MEDIUM). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating that it requires network access and user interaction but no privileges. The vulnerability is categorized under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) (GitHub Advisory).

The vulnerability affects the integrity of data with low severity, while having no impact on confidentiality or availability. The scope is unchanged, meaning the vulnerability is contained within the same security scope as the vulnerable component (GitHub Advisory).

The vulnerability has been patched in Twig version 3.19.0. Users are advised to upgrade to this version or later to address the security issue. The fix involves properly implementing output escaping for expressions on the left side of the ?? operator (GitHub Commit).