medium4.9
CVE-2025-52994
phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function
Impact
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | james-heinrich/phpthumb | <= 1.7.23 | none recorded |
Affected products
| Product | Affected versions |
|---|---|
| PhpThumb | through 1.7.23 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82
- https://github.com/JamesHeinrich/phpThumb/releases
- https://safety-online.pl/cve-2025-52994/
- https://github.com/advisories/GHSA-q745-cfqh-hcrw
- https://nvd.nist.gov/vuln/detail/CVE-2025-52994
- https://safety-online.pl/cve-2025-52994