Code injection in topthink/think

CRITICO 9.8CVE-2020-17952 · GHSA-ch3r-vp46-8g22 · Published 26/07/2021 · updated 17/06/2026

In breve

CVE-2020-17952 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda topthink/think, twothink (twothink project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.5% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
topthink/think Packagist	`≤ 6.0.9`	No fix yet
twothink twothink_project	`= 2.0`	No fix yet

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.

NVD description

A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.