CVE-2024-51754 - CVE House

Back to Database

Status published Low CVE-2024-51754

Unguarded calls to __toString() when nesting an object into an array in Twig

2.2 CVSS

Vulnerability Description

Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51754

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from twigphp

View All →

Twig fixes a security issue where escaping was missing when using null coalesce operator (??)

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

Twig has a possible sandbox bypass

Twig may load a template outside a configured directory when using the filesystem loader

Code injection in Twig

Affected Vendor

twigphp

View all reports →

Affected Software

Twig

Vulnerable Versions:

< 3.11.2, >= 3.12.0, < 3.14.1

Timeline

Official Publish: November 6th, 2024

Last Modified: May 29th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1078 Valid Accounts