CVE-2018-25270CWE-639

ThinkPHP 5.0.23 Remote Code Execution via invokefunction

Critical · published April 22, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00890 · 59.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-22T14:57Z
EPSS history
Timeline
  • 22 APR 14:57Z
    ThinkPHP 5.0.23 Remote Code Execution via invokefunction
    cvelistv5