CVE-2025-63889

High · 7.5

CVSS

7.5

EPSS

0.3%

Published

Nov 20, 2025

CISA due date

—

The record

The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.

Affected packages

Ecosystem	Package	Introduced	Fixed