{"id":"CVE-2020-25540","aliases":["EUVD-2022-2036","GHSA-2qm5-r82g-5hcx"],"status":"published","title":"ThinkAdmin directory traversal vulnerability","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.75332,"percentile":0.99517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2020-09-14T12:22:40Z","modified":"2026-06-17T03:06:53Z","exploits":[{"source":"exploitdb","id":"EDB-48812","title":"ThinkAdmin 6 -  Arbitrarily File Read","type":"webapps","platform":"php","date":"2020-09-15","url":"https://www.exploit-db.com/exploits/48812"},{"source":"nuclei","id":"CVE-2020-25540","title":"ThinkAdmin 6 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25540.yaml"},{"source":"pocgithub","id":"RajChowdhury240/ThinkAdmin-CVE-2020-25540","title":"RajChowdhury240/ThinkAdmin-CVE-2020-25540","date":"2022-03-09","url":"https://github.com/RajChowdhury240/ThinkAdmin-CVE-2020-25540"},{"source":"pocgithub","id":"Schira4396/CVE-2020-25540","title":"Schira4396/CVE-2020-25540","date":"2020-10-19","url":"https://github.com/Schira4396/CVE-2020-25540"},{"source":"pocgithub","id":"lowkey0808/cve-2020-25540","title":"lowkey0808/cve-2020-25540","date":"2022-05-10","url":"https://github.com/lowkey0808/cve-2020-25540"},{"source":"pocgithub","id":"simonlee-hello/CVE-2020-25540","title":"simonlee-hello/CVE-2020-25540","date":"2024-07-11","url":"https://github.com/simonlee-hello/CVE-2020-25540"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"zoujingli/thinkadmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0"},{"last_affected":"6.0"}]}],"versions":["6.0"]},{"source":"osv","ecosystem":"Packagist","package":"zoujingli/thinkadmin","versions":["6.0"]}],"products":[{"vendor":"thinkadmin","product":"thinkadmin"}],"references":[{"url":"https://github.com/zoujingli/ThinkAdmin/issues/244","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25540","tags":["advisory"]},{"url":"https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96","tags":["web"]},{"url":"https://github.com/zoujingli/ThinkAdmin/commit/ff2ab47cfabd4784effbf72a2a386c5d25c43a9a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2qm5-r82g-5hcx"},{"url":"https://github.com/zoujingli/ThinkAdmin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-25540","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","status":"published","published":"2020-09-14T12:22:40Z","modified":"2024-08-04T15:33:05.753Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2022-2036","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","status":"published","published":"2020-09-14T12:22:40Z","modified":"2024-08-04T15:33:05Z","updated_at":"2026-11-03T03:07:17.317062Z"}],"ghsa":[{"id":"GHSA-2qm5-r82g-5hcx","title":"ThinkAdmin directory traversal vulnerability","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","status":"published","published":"2022-05-24T17:28:15Z","modified":"2025-05-15T21:16:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:43.998596Z"}],"nvd":[{"id":"CVE-2020-25540","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","status":"published","published":"2020-09-14T13:15:10.22Z","modified":"2026-06-17T03:06:53.58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"GHSA-2qm5-r82g-5hcx","title":"ThinkAdmin directory traversal vulnerability","description":"ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.","status":"published","published":"2022-05-24T17:28:15Z","modified":"2025-05-15T21:16:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:34.700741Z"}]}}