Arbitrary Code Execution (ACE)

topthink/framework is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper input handling in the routecheck function, which allows an attacker to execute arbitrary code remotely...

ThinkPHP Routecheck Code Execution

The vulnerability of the routecheck function in the ThinkPHP framework is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending specially crafted commands...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

Directory Traversal

Overview topthink/framework is a The ThinkPHP Framework. Affected versions of this package are vulnerable to Directory Traversal via the routecheck function. An attacker can execute arbitrary code on the system by sending specially crafted requests that exploit improper path validation. Details A...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

ThinkPHP security vulnerabilities

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology ThinkPHP. A security vulnerability exists in thinkphp version v.5.1, which stems from a routecheck function that allows execution of arbitrary code...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50706: Improper Control of Generation of Code

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50706

The ThinkPHP Framework (v.5.1) is vulnerable to Remote Code Execution (RCE) due to improper input handling and insufficient path validation within the routecheck function. An attacker can exploit this Directory Traversal vulnerability by sending specially crafted requests—such as using "dot-dot-s...