CVE-2018-25270

ThinkPHP 5.0.23 Remote Code Execution via invokefunction

Critical9.3EPSS 0.89%

Published: 22 Apr 2026
Updated: 22 Apr 2026
Reserved: 22 Apr 2026
Assigned by: VulnCheck

Description

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.

Scores

CVSS scores of CVE-2018-25270, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	4.0	Critical9.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.89% · top 40% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

CWE-639: Authorization Bypass Through User-Controlled Key (opens in a new tab)All about CWE-639 and its CVEs

Affected products

Thinkphp · ThinkPHP
- affected 5.0.23
- affected 5.1.31

References (4)

ExploitDB-45978 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
VulnCheck Advisory: ThinkPHP 5.0.23 Remote Code Execution via invokefunction (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25270](https://trackcve.app/badge/CVE-2018-25270.svg)](https://trackcve.app/cve/CVE-2018-25270)

Record last updated 22 Apr 2026, 15:59 UTC.