ThinkPHP deserialization vulnerability

CRÍTICO 9.8CVE-2022-38352 · GHSA-qjjj-7g7h-54v3 · Published 15/09/2022 · updated 17/06/2026

Em resumo

CVE-2022-38352 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta topthink/framework, thinkphp (thinkphp).
Chance de exploração nos próximos 30 dias (EPSS): 21.0%, maior que 97.6% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
topthink/framework Packagist	`≤ 6.0.13`	No fix yet
thinkphp thinkphp	`= 6.0.13`	No fix yet

Description

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

NVD description

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

References

nvd.nist.gov/vuln/detail/CVE-2022-38352 · ADVISORY
top-think/framework · WEB
top-think/framework · PACKAGE

Mais vulnerabilidades de topthink/framework

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

topthink/framework

Packagist

≤ 6.0.13

No fix yet

thinkphp

= 6.0.13

No fix yet

Description

NVD description

Mais vulnerabilidades de topthink/framework

Ver tudo →