CVE-2022-45982

Deserialization of Untrusted Data in thinkphp

9.8 Critical

CVE-2022-45982 is a critical vulnerability (CVSS 9.8) in Thinkphp, published February 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. No source names a fixed version.

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.23%Down 1.3 points since Feb 9, 2023

What each source reports

NVD Score used 9.8

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: CVE-2022-45982
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

CVE List 9.8

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: CVE-2022-45982
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

EUVDEUVD-2023-0726 9.8

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: EUVD-2023-0726
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j2h2-g882-x9j2 9.8

Deserialization of Untrusted Data in thinkphp

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: GHSA-j2h2-g882-x9j2
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: CVE-2022-45982
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-j2h2-g882-x9j2 9.8

Deserialization of Untrusted Data in thinkphp

thinkphp 6.0.0~~6.0.13 and 6.1.0~~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Record: GHSA-j2h2-g882-x9j2
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

Affected products

thinkphp

Affected packages

Affected packages
Package	Affected	Fixed
`topthink/think` Packagist	through 6.1.1	None known
`topthink/think` Packagist	through 6.1.1, plus listed versions 5.05.0-rc15.0-rc2v5.0.1v5.0.10 Show 45 moreShow less v5.0.11v5.0.12v5.0.13v5.0.14v5.0.15v5.0.16v5.0.18v5.0.19v5.0.2v5.0.20v5.0.22v5.0.23v5.0.24v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1-beta.1v5.1-rc.3v5.1.0v5.1.10v5.1.11v5.1.12v5.1.13v5.1.14v5.1.15v5.1.16v5.1.17v5.1.19v5.1.20v5.1.21v5.1.22v5.1.23v5.1.24v5.1.25v5.1.26v5.1.27v5.1.28v5.1.29v5.1.31v5.1.32v5.1.34	None known

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

This page doesn't list everything

Left out here: 26 versions. The JSON record has them.