CVE-2021-44892: ThinkPHP

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.

Affected products

• ThinkPHP ThinkPHP: version 3.2.3 only

Published 2022-02-10. Last modified 2026-06-17.