phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

Command Injection

Overview james-heinrich/phpthumb is a The PHP thumbnail generator Affected versions of this package are vulnerable to Command Injection via the gifoutputAsJpeg function in phpthumb.gif.php file. An attacker can execute arbitrary operating system commands by supplying a specially crafted parameter...

GHSA-Q745-CFQH-HCRW phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994: Improper Neutralization of Special Elements used in an OS Command

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...

CVE-2025-52994

gifoutputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709...