PT-2025-47611 · Unknown · Thinkphp 5.0.24

Published 2025-11-20 · Updated 2025-11-25 · CVE-2025-63888

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkPHP version 5.0.24

Description The read function within the thinkphplibrarythinktemplatedriverFile.php file in ThinkPHP 5.0.24 has a remote code execution issue. The function allows for the execution of arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Weakness Enumeration

CWE-98

CWE-77

Related Identifiers

CVE-2025-63888

Affected Products

Thinkphp 5.0.24

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-63888 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63888 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1991657963732263110 · Twitter Post
• https://twitter.com/CVEnew/status/1991572997103136915 · Twitter Post
• https://gist.github.com/Master-0-0/0bf54cbb335b586b42b0db0db804e7aa · Note
• https://yuque.com/lcc316/df0kgm/mglhbxltgbmzfh2s · Note
• https://t.me/CVEtracker/37848 · Telegram Post
• https://t.me/cveNotify/143958 · Telegram Post