What’s Vulnerable › Vulnerabilities

CVE-2018-25270: ThinkPHP 5.0.23 Remote Code Execution via invokefunction

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-22 · updated 2026-06-17
• Weakness: CWE-639

Description

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

Affected products

• ThinkPHP: from 5.0.0 before 5.0.23; 5.1.31 — fixed in 5.0.23

How to fix

Upgrade to a fixed version: ThinkPHP 5.0.23. Check the vendor advisory for mitigations.

References

• https://github.com/top-think/framework/
• https://thinkphp.cn
• https://www.exploit-db.com/exploits/45978
• https://www.vulncheck.com/advisories/thinkphp-remote-code-execution-via-invokefunction

Get alerted when CVE-2018-25270 or the next vulnerability affects your stack