What’s Vulnerable › Vulnerabilities

CVE-2021-23592: Deserialization of Untrusted Data

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-06 · updated 2026-06-17
• Weakness: CWE-502

Description

The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

Affected products

• ThinkPHP: before 6.0.12 — fixed in 6.0.12

How to fix

Upgrade to a fixed version: ThinkPHP 6.0.12. Check the vendor advisory for mitigations.

References

• https://github.com/top-think/framework/commit/d3b5aeae94bc71bae97977d05cd12c3e0550905c
• https://github.com/top-think/framework/releases/tag/v6.0.12
• https://snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695
• https://github.com/top-think/framework/commit/d3b5aeae94bc71bae97977d05cd12c3e0550905c
• https://github.com/top-think/framework/releases/tag/v6.0.12
• https://snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695

Get alerted when CVE-2021-23592 or the next vulnerability affects your stack