CVE-2025-24374

Summary

CVE-2025-24374 is a vulnerability affecting Twig, a popular template engine used in PHP applications. The issue arises when the ?? operator is used without proper output escaping for the expression on the left side. This oversight could lead to arbitrary code injection, potentially enabling attackers to execute malicious code. The vulnerability has been addressed in Twig version 3.19.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.