What’s Vulnerable › Vulnerabilities

CVE-2022-47945

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 30.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-23 · updated 2026-06-17
• Weakness: CWE-22

Description

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

Affected products

• ThinkPHP: before 6.0.14 — fixed in 6.0.14

How to fix

Upgrade to a fixed version: ThinkPHP 6.0.14. Check the vendor advisory for mitigations.

References

• https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099
• https://github.com/top-think/framework/compare/v6.0.13...v6.0.14
• https://tttang.com/archive/1865/
• https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099
• https://github.com/top-think/framework/compare/v6.0.13...v6.0.14
• https://tttang.com/archive/1865/

Get alerted when CVE-2022-47945 or the next vulnerability affects your stack