Medium severity4.9OSV Advisory· Published Jul 11, 2025· Updated Apr 15, 2026

CVE-2025-52994

Description

gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.gif.php OS Command Injection via a crafted parameter value. This is fixed in 1.7.23-202506081709.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
james-heinrich/phpthumbPackagist	<= 1.7.23	—

Affected products

JamesHeinrich/PhpthumbOSV
Range: v1.7.12, v1.7.13, v1.7.14, …

Patches

cdcbc206ae60

https://github.com/jamesheinrich/phpthumbvia osv

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/advisories/GHSA-q745-cfqh-hcrwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-52994ghsaADVISORY
github.com/JamesHeinrich/phpThumb/commit/cdcbc206ae601b15fd17e7aadf59df51149a0e82nvdWEB
safety-online.pl/cve-2025-52994ghsaWEB
safety-online.pl/cve-2025-52994/nvd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000