CVE-2025-50706: ThinkPHP Framework Path Traversal Vulnerability
Summary
CVE-2025-50706: ThinkPHP Path Traversal Vulnerability. Affects topthink/framework versions < 5.1.41. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ThinkPHP is a popular PHP framework designed for rapid web application development. It offers a range of features including MVC architecture, built-in ORM, and support for RESTful APIs. However, versions prior to 5.1.42 are vulnerable to a critical path traversal issue that can allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability arises from the routecheck function in ThinkPHP Framework v.5.1, which does not properly validate user input. This oversight allows remote attackers to exploit the system by crafting malicious requests that can lead to arbitrary code execution. The implications of this vulnerability are severe, as it can compromise the integrity and security of the affected application, potentially leading to data breaches or unauthorized access.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation and sanitization measures to mitigate the risk of exploitation. Additionally, restrict access to sensitive routes and monitor application logs for any suspicious activity.
Conclusion
The ThinkPHP Framework has a critical vulnerability (CVE-2025-50706) that can lead to arbitrary code execution. It is essential to update to version 5.1.42 or later to mitigate this risk. Users should also consider implementing additional security measures in the interim.
See every vulnerability recorded for topthink/framework →
FAQ
CVE-2025-50706 is a critical vulnerability in the ThinkPHP Framework that allows remote attackers to execute arbitrary code due to improper input validation.
The vulnerability affects ThinkPHP versions prior to 5.1.42.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and compromise of the application's integrity.
Implement input validation and sanitization, restrict access to sensitive routes, and monitor application logs for suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for topthink/framework.
