CVE-2024-51754: Resource Exposure (CVSS 2.2)

Description

Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue.

Is your site exposed to CVE-2024-51754?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

2.2

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-668 CWE-668

References

Other References

https://github.com/twigphp/Twig/commit/2bb8c2460a2c519c498df9b643d5277117155a73 https://github.com/twigphp/Twig/security/advisories/GHSA-6377-hfv9-hqf6 https://lists.debian.org/debian-lts-announce/2025/05/msg00039.html

Frequently Asked Questions

What is CVE-2024-51754? +

Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of an array or an argument list (arguments to a function or a filter for instance). This issue has been patched in versions 3.11.2 and 3.14.1. All users are advised to upgrade. There are no known workarounds for this issue. It has a CVSS v3.1 base score of 2.2 (LOW).

How severe is CVE-2024-51754? +

CVE-2024-51754 has a CVSS v3.1 score of 2.2 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

How do I check if I'm vulnerable to CVE-2024-51754? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-34094

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before …

CVE-2025-6788

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, …

CVE-2025-54502

Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with …

CVE-2025-9074

A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via …

CVE-2026-47141

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they …

CVE-2026-72924

GitHub CLI (gh) is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh …

CVE-2024-51754