{"id":"GHSA-4vp2-mj4m-69m4","aliases":["CVE-2020-23653"],"title":"ThinkAdmin insecure unserialize vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in `app/admin/controller/api/Update.php `and `app/wechat/controller/api/Push.php`, which may lead to arbitrary remote code execution.","severity":"critical","score":9.8,"published":"2022-05-24T17:38:58.000Z","modified":"2025-05-15T18:48:21.000Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"zoujingli/thinkadmin","sources":[{"name":"OSV · GHSA-4vp2-mj4m-69m4","url":"https://osv.dev/vulnerability/GHSA-4vp2-mj4m-69m4"}],"ranges":[{"events":[{"introduced":"4.0"},{"fixed":"6.1.0"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["6.1.0"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-23653","https://github.com/zoujingli/ThinkAdmin/issues/238","https://github.com/zoujingli/ThinkAdmin/commit/640a61ae0772dcd5209d74dff8ad373e61e8ad8c","https://github.com/zoujingli/ThinkAdmin/commit/6ccd4055fc40d2d7d154920a1859a7c19774bd1a","https://github.com/zoujingli/ThinkAdmin/commit/b8a2ded90866a285e9022c842e546d8a6fa5fa6d","https://github.com/zoujingli/ThinkAdmin"],"sources":[{"name":"OSV","id":"GHSA-4vp2-mj4m-69m4","modified":"2025-05-15T18:48:21Z","url":"https://osv.dev/vulnerability/GHSA-4vp2-mj4m-69m4"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T09:15:31.408Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}