# topthink/framework (Packagist) vulnerabilities

19 known vulnerabilities (3 critical, 2 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/topthink/framework

## Advisories (19)

### [CVE-2025-50706](https://cve.now/CVE-2025-50706): An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function

- Severity: Critical 9.8
- Published: Aug 5, 2025
- Affected: through 5.1.41.

### [CVE-2024-44902](https://cve.now/CVE-2024-44902): A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

- Severity: Critical 9.8
- Published: Sep 9, 2024
- Affected: from 6.1.3, through 8.0.4.

### [CVE-2024-34467](https://cve.now/CVE-2024-34467): ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think\_exception.tpl.

- Severity: Medium 6.1
- Published: May 4, 2024
- Affected: from 8.0.0, fixed in 8.0.4; from 6.1.0, fixed in 6.1.5; fixed in 6.0.17.

### [CVE-2022-47945](https://cve.now/CVE-2022-47945): ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled…

- Severity: Critical 9.8
- Published: Dec 23, 2022
- Affected: fixed in 6.0.14.

### [CVE-2022-44289](https://cve.now/CVE-2022-44289): Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.

- Severity: High 8.8
- Published: Dec 6, 2022
- Affected: through 5.0.24; from 5.1, through 5.1.41.

### [CVE-2022-38352](https://cve.now/CVE-2022-38352): ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\\Flysystem\\Cached\\Storage\\Psr6Cache.

- Severity: Unrated
- Published: Sep 15, 2022
- Affected: through 6.0.13.

### [CVE-2022-33107](https://cve.now/CVE-2022-33107): ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component…

- Severity: Unrated
- Published: Jun 29, 2022
- Affected: through 6.0.12.

### [CVE-2021-23592](https://cve.now/CVE-2021-23592): Deserialization of Untrusted Data

- Severity: High 7.7
- Published: May 6, 2022
- Affected: fixed in 6.0.12.

### [CVE-2022-25481](https://cve.now/CVE-2022-25481): ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.

- Severity: Medium 4.0
- Published: Mar 20, 2022
- Affected: through 5.0.24.

### [CVE-2021-44892](https://cve.now/CVE-2021-44892): A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value\[\_filename\] in index.php, which could let a malicious user…

- Severity: Unrated
- Published: Feb 10, 2022
- Affected: through 3.2.3.

### [CVE-2021-44350](https://cve.now/CVE-2021-44350): SQL Injection vulnerability exists in ThinkPHP5 5.0.x \<=5.1.22 via the parseOrder function in Builder.php.

- Severity: Unrated
- Published: Dec 15, 2021
- Affected: from 5.0, through 5.1.22.

### [CVE-2021-36567](https://cve.now/CVE-2021-36567): ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\\Flysystem\\Cached\\Storage\\AbstractCache.

- Severity: Unrated
- Published: Dec 6, 2021
- Affected: through 6.0.8.

### [CVE-2021-36564](https://cve.now/CVE-2021-36564): ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component…

- Severity: Unrated
- Published: Dec 6, 2021
- Affected: fixed in 6.0.9.

### [CVE-2018-18546](https://cve.now/CVE-2018-18546): ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the…

- Severity: Unrated
- Published: Oct 21, 2018
- Affected: through 3.2.4.

### [CVE-2018-18530](https://cve.now/CVE-2018-18530): ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the…

- Severity: Unrated
- Published: Oct 19, 2018
- Affected: through 5.1.25.

### [CVE-2018-18529](https://cve.now/CVE-2018-18529): ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles…

- Severity: Unrated
- Published: Oct 19, 2018
- Affected: through 3.2.4.

### [CVE-2018-17566](https://cve.now/CVE-2018-17566): In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's…

- Severity: Unrated
- Published: Sep 26, 2018
- Affected: versions 5.1.24.

### [CVE-2018-16385](https://cve.now/CVE-2018-16385): ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

- Severity: Unrated
- Published: Sep 3, 2018
- Affected: fixed in 5.1.23.

### [CVE-2018-10225](https://cve.now/CVE-2018-10225): thinkphp 3.1.3 has SQL Injection via the index.php s parameter.

- Severity: Unrated
- Published: Apr 19, 2018
- Affected: versions 3.1.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/topthink/framework
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.