CVE-2013-6919

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

4.3 MediumFix available

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.

Exploit likelihood

1.19%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-6919
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6919
Updated: 2026-11-02

EUVDEUVD-2022-2124 No score

Record: EUVD-2022-2124
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3747-gjc9-vvg6 No score

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

Record: GHSA-3747-gjc9-vvg6
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-3747-gjc9-vvg6 No score

phpThumb is vulnerable to Server-Side Request Forgery (SSRF)

Record: GHSA-3747-gjc9-vvg6
Weakness: CWE-918
Updated: 2026-11-02

Affected products

phpthumb project phpthumb

Affected packages

Affected packages
Package	Affected	Fixed
`james-heinrich/phpthumb` Packagist	before 1.7.12	1.7.12

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6919 is a medium vulnerability (CVSS 4.3) in Phpthumb Project Phpthumb, published December 27, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in james-heinrich/phpthumb 1.7.12.