CVE-2024-44902

A deserialization vulnerability in ThinkPHP versions 6.1.3 through 8.0.4 allows attackers to execute arbitrary code remotely. The issue stems from unsafe processing of input data during deserialization.

An attacker can take over the server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.

Immediately update ThinkPHP to the latest available version that includes the security fix. Additionally, restrict access to the application and implement input validation mechanisms.