CVE-2022-33107

CRITICAL

ThinkPHP 6.0.12 - Remote Code Execution via Flysystem Cached Adapter Deserialization

Title source: llm
STIX 2.1

Description

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/top-think/framework/issues/2717

Scores

CVSS v3 9.8
EPSS 0.2189
EPSS Percentile 97.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (2)
thinkphp/thinkphp 6.0.12
topthink/framework 0Packagist
Published Jun 29, 2022
Tracked Since Feb 18, 2026