CVE-2018-25270 ThinkPHP 5.0.23 Remote Code Execution via invokefunction
Unauthenticated attackers can execute arbitrary PHP code via malicious routing parameters in ThinkPHP, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25270?
CVE-2018-25270 is a critical code injection vulnerability in ThinkPHP, published on 22 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
Weakness: CWE-639
Which versions are affected by CVE-2018-25270?
It affects 1 product.
Products include Thinkphp Thinkphp.
How do I fix CVE-2018-25270?
No fix has been published for CVE-2018-25270 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2018-25270 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25270 exists.
Other vulnerabilities in ThinkPHP
Sources
Also known as GHSA-98w3-frc2-62p8.