Open-source package vulnerability · Composer (PHP)
CVE-2024-44902: ThinkPHP deserialization vulnerability
criticalCVSS 4.0 9.3 · 3.1 9.8GHSA-f4wh-359g-4pq7
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Published Sep 9, 2024
Affected packages
topthink/framework
- Ecosystem
- Composer (PHP)
- Affected
- >= 6.1.3, <= 8.0.4
- Fixed in
- No patched version yet
- Check
composer show topthink/framework
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology