Deserialization of Untrusted Data in topthink/framework

CRITICAL 9.8CVE-2022-33107 · GHSA-g377-x8rg-c9mf · Published 29/06/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
topthink/framework Packagist	`≤ 6.0.12`	No fix yet
thinkphp thinkphp	`= 6.0.12`	No fix yet

Description

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-33107 · ADVISORY
top-think/framework · WEB
top-think/framework · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free