ThinkPHP 5.0.23 contains a remote code execution flaw that allows unauthenticated attackers to craft requests to the index.php endpoint with malicious function parameters, enabling the execution of arbitrary PHP code with the privileges of the application. This vulnerability is a classic authorization bypass (CWE-639) and could be leveraged to run system commands, exfiltrate data, or take complete control of the affected server.

ThinkPHP is a PHP framework that is used widely across web applications. The impact is limited to ThinkPHP installations running the following versions: 5.0.23, 5.1.31, 6.0.15, 6.0.16, 6.1.3 through 6.1.5, and 8.0.0 (including the beta, 8.0.1, 8.0.2, 8.0.3, and 8.0.4 releases.

The CVSS score of 9.3 places this flaw in the high‑severity category. EPSS is not available, but the absence of authentication and the straightforward HTTP request required for exploitation suggest a high likelihood of real‑world attacks. The vulnerability is not listed in CISA's KEV catalog, yet its potential to allow an attacker to execute code on the server remains significant. Countermeasures would need to prevent unauthenticated use of the invokefunction route or enable robust input validation.