CVE-2025-63889: High severity ThinkPHP ThinkPHP vulnerability
Published Nov 20, 2025
·Updated
The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
Affected Software
2 affected components
ThinkPHP ThinkPHP
ThinkPHP ThinkPHP=5.0.24
Event History
Nov 20, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-63889?
CVE-2025-63889 has a severity rating that indicates a significant potential for file exposure due to improper validation in ThinkPHP.
2
How do I fix CVE-2025-63889?
To fix CVE-2025-63889, upgrade to the latest stable version of ThinkPHP that addresses this vulnerability.
3
What types of attacks can exploit CVE-2025-63889?
CVE-2025-63889 can be exploited through crafted template values that allow attackers to read arbitrary files on the server.
4
Which version of ThinkPHP is affected by CVE-2025-63889?
CVE-2025-63889 specifically affects ThinkPHP version 5.0.24.
5
What should I do if I cannot upgrade to a new version to mitigate CVE-2025-63889?
If an upgrade is not possible, consider implementing strict input validation and file path sanitization to mitigate CVE-2025-63889.