PT-2025-47609 · Unknown · Thinkphp 5.0.24

Published 2025-11-20 · Updated 2025-11-25 · CVE-2025-63889

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.0.24

Description The fetch function within the thinkphplibrarythinkTemplate.php file in ThinkPHP 5.0.24 has a flaw that allows attackers to read arbitrary files by using a specially crafted file path within a template value. The function does not properly sanitize the file path, potentially leading to unauthorized file access.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the fetch function or carefully validate all file paths used in template values to prevent unauthorized file access.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-63889

Affected Products

Thinkphp 5.0.24

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-63889 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63889 · Vendor Advisory
• https://twitter.com/CVEnew/status/1991565349423112335 · Twitter Post
• https://t.me/CVEtracker/37849 · Telegram Post
• https://gist.github.com/Master-0-0/dd63209602f04267f1a27a75a064df26 · Note
• https://yuque.com/lcc316/df0kgm/xqkrw5rfz5vqxo9t · Note
• https://t.me/cveNotify/143959 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991652843929960936 · Twitter Post