Medium
CVSS 4.9
Overview
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.
CVE-2025-52994
gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command I...
Risk analysis
This vulnerability is rated 🟡 MEDIUM.
- CVSS: 4.9 (MEDIUM)
- Detected tags: command_injection (tag impact: LOW)
Recommended actions:
- Prioritize remediation based on business criticality and exposure.
- Limit exposure and increase monitoring until fixed.