Thinkphp vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Thinkphp flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2019-9082 ThinkPHP Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 8.8
• CVE-2018-20062 ThinkPHP "noneCms" Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8

Latest high and critical flaws

• CVE-2018-25270 ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions throughCritical 9.3 · Apr 22, 2026
• CVE-2025-63889 The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template vHigh 7.5 · Nov 20, 2025
• CVE-2025-63888 The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.Critical 9.8 · Nov 20, 2025
• CVE-2025-50707 An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php componentCritical 9.8 · Aug 5, 2025
• CVE-2025-50706 An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck functionCritical 9.8 · Aug 5, 2025
• CVE-2024-48112 A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.Critical 9.8 · Oct 30, 2024
• CVE-2024-44902 A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.Critical 9.8 · Sep 9, 2024
• CVE-2022-45982 thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.Critical 9.8 · Feb 8, 2023
• CVE-2022-47945 ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true).Critical 9.8 · Dec 23, 2022
• CVE-2022-44289 Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.High 8.8 · Dec 6, 2022
• CVE-2022-38352 ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.Critical 9.8 · Sep 14, 2022
• CVE-2022-33107 ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.phCritical 9.8 · Jun 29, 2022
• CVE-2021-23592 The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.High 7.7 · May 6, 2022
• CVE-2022-25481 ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.High 7.5 · Mar 20, 2022
• CVE-2021-44892 A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control pHigh 8.8 · Feb 10, 2022
• CVE-2021-44350 SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.Critical 9.8 · Dec 15, 2021
• CVE-2021-36567 ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.Critical 9.8 · Dec 6, 2021
• CVE-2021-36564 ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.Critical 9.8 · Dec 6, 2021
• CVE-2020-20120 ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.Critical 9.8 · Sep 28, 2021
• CVE-2019-9082 ThinkPHP Remote Code ExecutionExploited · High 8.8 · Feb 24, 2019
• CVE-2018-20062 ThinkPHP "noneCms" Remote Code ExecutionExploited · Critical 9.8 · Dec 11, 2018
• CVE-2018-18546 ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.Critical 9.8 · Oct 20, 2018
• CVE-2018-18530 ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable.Critical 9.8 · Oct 19, 2018
• CVE-2018-18529 ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable.Critical 9.8 · Oct 19, 2018
• CVE-2018-17566 In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.Critical 9.8 · Sep 26, 2018