CVE-2024-51755 - CVE House
Back to Database
Status published Low CVE-2024-51755

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig

Vulnerability Description

Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property policy and the `__isset()` method is now called after the security check. This is a BC break. This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51755

Credits & Attribution

No credits recorded in the NVD database.

References

More from twigphp

View All →
CVE-2025-24374
Twig fixes a security issue where escaping was missing when using null coalesce operator (??)
Medium 4.3
CVE-2024-51754
Unguarded calls to __toString() when nesting an object into an array in Twig
Low 2.2
CVE-2024-45411
Twig has a possible sandbox bypass
High 8.6
CVE-2022-39261
Twig may load a template outside a configured directory when using the filesystem loader
High 7.5
CVE-2022-23614
Code injection in Twig
High 8.8

Affected Vendor

Affected Software

Twig
Vulnerable Versions:
< 3.11.2, >= 3.12.0, < 3.14.1

Timeline

Official Publish: November 6th, 2024
Last Modified: November 7th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-668

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence