Home

Description

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

PUBLISHED Reserved 2026-04-22 | Published 2026-04-22 | Updated 2026-04-22 | Assigner VulnCheck




CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Authorization Bypass Through User-Controlled Key

Product status

5.0.23
affected

5.1.31
affected

Credits

VulnSpy finder

References

www.exploit-db.com/exploits/45978 (ExploitDB-45978) exploit

thinkphp.cn (Official Product Homepage) product

github.com/top-think/framework/ (Product Reference) product

www.vulncheck.com/...emote-code-execution-via-invokefunction (VulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction) third-party-advisory

cve.org (CVE-2018-25270)

nvd.nist.gov (CVE-2018-25270)

Download JSON