Deserialization of Untrusted Data in thinkphp

CRITICAL 9.8CVE-2022-45982 · GHSA-j2h2-g882-x9j2 · Published 08/02/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
topthink/think Packagist	`≤ 6.1.1`	No fix yet
thinkphp thinkphp	`= 6.1.0≥ 6.0.0, ≤ 6.0.13`	No fix yet

Description

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

NVD description

thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

References

nvd.nist.gov/vuln/detail/CVE-2022-45982 · ADVISORY
gist.github.com/Dar1in9s/aa87df679057db3bbdade360d77f8cca · WEB
top-think/think · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free