What’s Vulnerable › Vulnerabilities

CVE-2025-52994

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-11 · updated 2026-06-17
• Weakness: CWE-78

Description

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

Affected products

• phpThumb project phpThumb: through 1.7.23

References

• https://github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82
• https://github.com/JamesHeinrich/phpThumb/releases
• https://safety-online.pl/cve-2025-52994/

Get alerted when CVE-2025-52994 or the next vulnerability affects your stack