Tag: template injection
All the articles with the tag "template injection".
-
[CVE-2025-63888] ThinkPHP 5.0.24 Template File Inclusion Drops a Remote Shell
A path-traversal flaw in ThinkPHP’s File template driver lets unauthenticated attackers include arbitrary files and execute embedded PHP. Proof-of-concept code is public and exploitation requires only the ability to upload a file.