Twig security issue where escaping was missing when using null coalesce operator

Description

References

• twigphp/Twig security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-24374 · ADVISORY
• twigphp/Twig commit 38576b1 · WEB
• FriendsOfPHP/security-advisories · WEB
• twigphp/Twig · PACKAGE
• symfony.com/blog/twig-cve-2025-24374-missing-output-escaping-for-the-null-coalesce-operator · WEB

More vulnerabilities in twig/twig

• CVE-2026-49981HIGH 8.2Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Templ…
• CVE-2026-48808HIGH 7.5Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward th…
• CVE-2026-48807CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join a…
• CVE-2026-48806CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allow…
• CVE-2026-48805CRITICAL 9.1Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sand…