BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-25

Assigner: MITRE

Description

The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63889

Affected Vendors & Products

Vendor	Product	Version / Range
thinkphp	thinkphp	5.0.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the fetch function of the file thinkphp\library\think\Template.php in ThinkPHP version 5.0.24. It allows attackers to read arbitrary files on the server by providing a specially crafted file path in a template value.

Impact Analysis

An attacker exploiting this vulnerability can read arbitrary files on the server, which may lead to exposure of sensitive information such as configuration files, credentials, or other private data stored on the server.

Hi! I’m here to help you understand CVE-2025-63889. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70