CVE-2018-25270: ThinkPHP 5.0.23 Remote Code Execution via invokefunction
Published Apr 22, 2026
·Updated
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
Affected Software
3 affected components
ThinkPHP ThinkPHP=5.0.23
ThinkPHP ThinkPHP>=5.0.0<5.0.23
ThinkPHP ThinkPHP=5.1.31
Event History
Apr 22, 2026
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-25270?
CVE-2018-25270 is classified as a critical remote code execution vulnerability.
2
How do I fix CVE-2018-25270?
To mitigate CVE-2018-25270, upgrade to ThinkPHP version 5.0.24 or later.
3
Who is affected by CVE-2018-25270?
CVE-2018-25270 affects applications running ThinkPHP version 5.0.23.
4
What type of vulnerability is CVE-2018-25270?
CVE-2018-25270 is a remote code execution vulnerability that allows attackers to execute arbitrary PHP code.
5
Can CVE-2018-25270 be exploited without authentication?
Yes, CVE-2018-25270 can be exploited by unauthenticated attackers.