The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Master-0-0/dd63209602f04267f1a27a75a064df26 | Mitigation Third Party Advisory |
| https://www.yuque.com/lcc316/df0kgm/xqkrw5rfz5vqxo9t | Permissions Required |
Configurations
History
25 Nov 2025, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/Master-0-0/dd63209602f04267f1a27a75a064df26 - Mitigation, Third Party Advisory | |
| References | () https://www.yuque.com/lcc316/df0kgm/xqkrw5rfz5vqxo9t - Permissions Required | |
| CPE | cpe:2.3:a:thinkphp:thinkphp:5.0.24:*:*:*:*:*:*:* | |
| First Time |
Thinkphp
Thinkphp thinkphp |
20 Nov 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-125 |
20 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-20 18:15
Updated : 2025-11-25 15:41
NVD link : CVE-2025-63889
Mitre link : CVE-2025-63889
CVE.ORG link : CVE-2025-63889
JSON object : View
Products Affected
thinkphp
- thinkphp
CWE
CWE-125
Out-of-bounds Read