CVE-2025-63889

—

CVSS 3.1

7.5 high

EPSS

<1%p23

Published

Nov 20, 2025 (Nov 20, 2025)

Modified

Jun 17, 2026

Description

The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.

Vendors: thinkphp
Products: thinkphp
Weakness: CWE-125
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.