GHSA-q745-cfqh-hcrw

phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-52994

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	james-heinrich/phpthumb	<= 1.7.23	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-52994 advisory
https://github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82 web
https://github.com/JamesHeinrich/phpThumb package
https://github.com/JamesHeinrich/phpThumb/releases web
https://safety-online.pl/cve-2025-52994 web