What is GHSA-q745-cfqh-hcrw?

GHSA-q745-cfqh-hcrw is a security advisory published by GitHub Security Advisories with Medium severity. phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

Which CVE IDs does GHSA-q745-cfqh-hcrw cover?

GHSA-q745-cfqh-hcrw covers the following CVE IDs: CVE-2025-52994. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q745-cfqh-hcrw?

GHSA-q745-cfqh-hcrw has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-q745-cfqh-hcrw?

GHSA-q745-cfqh-hcrw affects 1 product, including: composer/james-heinrich/phpthumb:\u003c= 1.7.23.

GHSA-q745-cfqh-hcrwMediumCVSS 4.9

phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

Vendor

GitHub Security Advisories

Published

July 11, 2025

Last Modified

July 11, 2025

🔗 CVE IDs covered (1)

CVE-2025-52994 →

📋 Description

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

🎯 Affected products1

composer/james-heinrich/phpthumb:<= 1.7.23

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-52994
https://github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82
https://github.com/JamesHeinrich/phpThumb/releases
https://safety-online.pl/cve-2025-52994
https://github.com/advisories/GHSA-q745-cfqh-hcrw