Thinkphp vulnerabilities
Published CVEs affecting Thinkphp products: 4 record(s), with severity, exploitation and fixes.
CVE-2018-25270
Critical · 9.8
CWE-639 Apr 22, 2026
ThinkPHP 5.0.23 Remote Code Execution via invokefunction
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
CVE-2025-63889
High · 7.5
CWE-125 Nov 20, 2025
Out-of-bounds Read in Thinkphp
The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
CVE-2025-63888
Critical · 9.8
CWE-98 Nov 20, 2025
PHP Remote File Inclusion in Thinkphp
The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
CVE-2019-9082
High · 8.8
KEV Urgent · 76 Public exploit CWE-94 Feb 24, 2019
ThinkPHP Remote Code Execution Vulnerability
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.