CVE-2024-44902
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk90th percentile - higher than 90% of all known CVEs
Summary
A deserialization vulnerability in ThinkPHP versions 6.1.3 through 8.0.4 allows attackers to execute arbitrary code remotely. The issue stems from unsafe processing of input data during deserialization.
Risk Assessment
An attacker can take over the server, steal data, or install malware, compromising the confidentiality, integrity, and availability of the system.
Recommendation
Immediately update ThinkPHP to the latest available version that includes the security fix. Additionally, restrict access to the application and implement input validation mechanisms.
Other vulnerabilities in ThinkPHP
See all- CVE-2025-63888Critical
The read function in thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
- CVE-2019-9082HighActively exploited
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
Original NVD description (English source)
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS