CVE-2019-9082: ThinkPHP Remote Code Execution Vulnerability

Q: How do I fix CVE-2019-9082?

thinkphp: upgrade to 3.2.4; open source background management system: downgrade or apply the listed mitigation; zzzphp: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Q: Is CVE-2019-9082 being exploited?

Yes. CVE-2019-9082 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2019-9082 affect?

CVE-2019-9082 affects thinkphp, open source background management system, zzzphp. Severity is high (CVSS 8.8). ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

Q: How urgent is CVE-2019-9082?

Priority 86/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Patch now

HIGH 8.8EXPLOITEDUPGRADEDOWNGRADEDOWNGRADE

CVE-2019-9082 is a high-severity flaw (CVSS 8.8) affecting thinkphp, open source background management system, zzzphp, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

Why this priority

High severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	97.4% (top 1%)
CISA exploited list	Yes, fix due 2022-05-03
Weakness	CWE-94, CWE-306
Published	2019-02-24
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: opensourcebms · thinkphp · zzzcms

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-02-24 18:29 UTCPublished CVE record published
2021-11-03Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-05-03Deadline CISA due date for US federal agencies to patch
2026-06-17 02:43 UTCUpdated Record last modified

thinkphp thinkphp UPGRADE

Affected: < 3.2.4

Fixed in: 3.2.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy thinkphp || rpm -q thinkphp || thinkphp --version

2. UPGRADE to 3.2.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade thinkphp

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade thinkphp

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

opensourcebms open source background management system DOWNGRADE

Affected: 1.1.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.1.1

1. Check installed version

apt-cache policy open-source-background-management-system || rpm -q open-source-background-management-system || open-source-background-management-system --version

2. No fixed release: DOWNGRADE to a release before 1.1.1 (Debian / Ubuntu)

apt-cache madison open-source-background-management-system sudo apt install open-source-background-management-system=<VERSION_BEFORE_1.1.1> sudo apt-mark hold open-source-background-management-system

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list open-source-background-management-system sudo dnf downgrade open-source-background-management-system-<VERSION_BEFORE_1.1.1> sudo dnf versionlock add open-source-background-management-system

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

zzzcms zzzphp DOWNGRADE

Affected: 1.6.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.6.1

1. Check installed version

apt-cache policy zzzphp || rpm -q zzzphp || zzzphp --version

2. No fixed release: DOWNGRADE to a release before 1.6.1 (Debian / Ubuntu)

apt-cache madison zzzphp sudo apt install zzzphp=<VERSION_BEFORE_1.6.1> sudo apt-mark hold zzzphp

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list zzzphp sudo dnf downgrade zzzphp-<VERSION_BEFORE_1.6.1> sudo dnf versionlock add zzzphp

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · nodejs-pnpm12 · FIXED · 12.17.0-1.fc46 · FEDORA-2026-7adfb2bcdd · source

sudo dnf upgrade --advisory=FEDORA-2026-7adfb2bcdd

Fedora ELN · wget2 · FIXED · 2.3.0-3.eln159 · FEDORA-2026-811b4922a5 · source

sudo dnf upgrade --advisory=FEDORA-2026-811b4922a5

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: github.com/xiayulei/open_source_bms/issues/33
Write-up: www.exploit-db.com/exploits/46488/
Exploit-DB: ThinkPHP - Multiple PHP Injection RCEs (Metasploit)
Exploit-DB: zzzphp CMS 1.6.1 - Cross-Site Request Forgery
Metasploit: ThinkPHP Multiple PHP Injection RCEs
Nuclei scan template: ThinkPHP < 3.2.4 - Remote Code Execution

Advisories and coverage

Official advisories

F5 Security Advisories: NoBooze1 Malware Targets TP-Link Routers via CVE-2019-9082 2025-07-16

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-9082?

thinkphp: upgrade to 3.2.4; open source background management system: downgrade or apply the listed mitigation; zzzphp: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-9082 being exploited?

Yes. CVE-2019-9082 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2019-9082 affect?

CVE-2019-9082 affects thinkphp, open source background management system, zzzphp. Severity is high (CVSS 8.8). ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.

How urgent is CVE-2019-9082?

Priority 86/100. High severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference

Related CVEs

CVE-2024-44902 CRITICAL 9.8 UPGRADE A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
CVE-2025-63889 HIGH 7.5 DOWNGRADE The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arb
CVE-2025-63888 CRITICAL 9.8 DOWNGRADE The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote
CVE-2025-50707 CRITICAL 9.8 DOWNGRADE An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
CVE-2025-50706 CRITICAL 9.8 DOWNGRADE An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function

References

← Back to latest CVEs