ThinkPHP Remote Code Execution (RCE) vulnerability

ALTO 8.8CVE-2021-44892 · GHSA-75jp-87w2-c6x2 · Published 10/02/2022 · updated 17/06/2026

In breve

CVE-2021-44892 è una vulnerabilità ALTO (CVSS 8.8) che riguarda topthink/framework, thinkphp (thinkphp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.0%, superiore al 81.0% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
topthink/framework Packagist	`≤ 3.2.3`	No fix yet
thinkphp thinkphp	`= 3.2.3`	No fix yet

Description

A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.

NVD description

A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.

References

nvd.nist.gov/vuln/detail/CVE-2021-44892 · ADVISORY
Stakcery/Web-Security · WEB
top-think/framework · PACKAGE

Altre vulnerabilità di topthink/framework

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

topthink/framework

Packagist

≤ 3.2.3

No fix yet

thinkphp

= 3.2.3

No fix yet

Description

A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.

NVD description

A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.

Altre vulnerabilità di topthink/framework

Vedi tutto →