CVE-2025-52994: Phpthumb Project Phpthumb

Medium severity, CVSS 4.9. EPSS: 0.7% chance of exploitation in the next 30 days.

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

Affected products

• Phpthumb Project Phpthumb: up to and including 1.7.23

Published 2025-07-11. Last modified 2026-06-17.