CVE-2022-33107 — Deserialization of Untrusted Data in...

CRITICAL

Deserialization of Untrusted Data in topthink/framework

Published June 30, 2022Updated November 8, 2023Source: osv

Summary

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Advisory Timeline

First published June 30, 2022 (1566 days ago).
Last revised November 8, 2023 — 496 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: packagist (1).

Package	Ecosystem	Affected	Fixed In
topthink/framework	packagist	5.0, 5.0-rc1, 5.0-rc2, 5.0-rc3 (+95 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-502
Deserialization of Untrusted DataMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-33107?: Deserialization of Untrusted Data in topthink/framework This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-33107?: CVE-2022-33107 affects topthink/framework. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-33107 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-g377-x8rg-c9mf

Related CVEs

CVE-2021-23592
CRITICAL
Deserialization of Untrusted Data in topthink/framework
CVE-2026-107845
CRITICAL
Contao: Cross-site scripting in the comments bundle
CVE-2024-44902
CRITICAL
ThinkPHP deserialization vulnerability
CVE-2026-92161
CRITICAL
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
CVE-2025-50706
CRITICAL
ThinkPHP Path Traversal Vulnerability
CVE-2022-47945
CRITICAL
ThinkPHP Framework vulnerable to remote code execution
CVE-2018-10225
CRITICAL
thinkphp SQL Injection via the index.php s parameter

More Packagist advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies