CVE-2025-50706: ThinkPHP Path Traversal Vulnerability

The vulnerability is a path traversal issue in ThinkPHP framework version 5.1.41 and below, specifically on Windows systems. The root cause is the improper sanitization of the s parameter, which is used for URL routing. An attacker can use ..\ sequences to traverse directories because the application's check for valid modules using is_dir can be bypassed on Windows.

The exploitation flow starts with the think\App::routeCheck function, which processes the request. The malicious payload is retrieved by think\Request::pathinfo. The core of the vulnerability lies in think\route\dispatch\Module::init, where the is_dir check fails to prevent directory traversal. Finally, think\App::loadFile is used to include a PHP file from the traversed directory, leading to remote code execution.

The analysis of the provided blog post was crucial in identifying the vulnerable functions and the exploitation chain, as no official patch commit was available.