Deserialization of Untrusted Data in topthink/framework

KRITISCH 9.8CVE-2021-23592 · GHSA-3fpv-54ff-wqfj · SNYK-PHP-TOPTHINKFRAMEWORK-2385695 · Published 06/05/2022 · updated 17/06/2026

Kurz gesagt

CVE-2021-23592 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in topthink/framework, thinkphp (thinkphp).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.7%, höher als bei 77.6% aller Schwachstellen.
Abhilfe: auf 6.0.12 oder neuer aktualisieren.

Package	Affected versions	Patched versions
topthink/framework Packagist	`< 6.0.12`	`6.0.12`
thinkphp thinkphp	`< 6.0.12`	`6.0.12`

Description

The package topthink/framework before version 6.0.12 is vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

NVD description

The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

References

nvd.nist.gov/vuln/detail/CVE-2021-23592 · ADVISORY
top-think/framework commit d3b5aea · WEB
top-think/framework · PACKAGE
top-think/framework release v6.0.12 · WEB
snyk.io/vuln/SNYK-PHP-TOPTHINKFRAMEWORK-2385695 · WEB

Weitere Schwachstellen in topthink/framework

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

topthink/framework

Packagist

< 6.0.12

6.0.12

thinkphp

< 6.0.12

6.0.12

Description

The package topthink/framework before version 6.0.12 is vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

NVD description

The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.

Weitere Schwachstellen in topthink/framework

Alle anzeigen →