GitHub Advisoryadvisory · Packagist

GHSA-mrwc-mvr8-9xq5 ThinkPHP Path Traversal Vulnerability

CRITICAL Published 2025-08-05 Modified 2025-08-05 Official page ↗

Aliases: CVE-2025-50706
Ecosystem: Packagist
Packages: topthink/framework
Severity: Critical
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-22
Reviewed: 2025-08-05

Affected packages

• Packagist topthink/framework: <= 5.1.41 (no fix yet)

Description

An issue in ThinkPHP Framework v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function.

Related

Alias · CVE (1)

CVE-2025-50706 An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References