CVE-2022-47945

Katalog CVE

CVSS 9.8 · Critical EPSS 28,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada thinkphp. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.

Rincian

Terbit di NVD

23 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

28,7% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/top-think/framework/commit/c4acb8b4001b98a0078eda25840d33e295a7f099 patch · advisory pihak ketiga
• https://github.com/top-think/framework/compare/v6.0.13...v6.0.14 patch · advisory pihak ketiga
• https://tttang.com/archive/1865/ exploit · advisory pihak ketiga