CVE-2022-38352: ThinkPHP

Critical severity, CVSS 9.8. EPSS: 21% chance of exploitation in the next 30 days.

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.

Affected products

• ThinkPHP ThinkPHP: version 6.0.13 only

Published 2022-09-15. Last modified 2026-06-17.