ThinkPHP - Authentication Bypass (CVE-2019-9082)

CVE-2019-9082 is a remote command execution vulnerability in ThinkPHP before version 3.2.4, which can be exploited via crafted requests to execute arbitrary system commands. Attackers can leverage this flaw to gain full control over affected servers, potentially leading to data theft, system compromise, or further attacks on connected systems.

CrowdSec has been tracking this vulnerability and its exploits since 7th of January 2026.

CrowdSec network data shows that most actors exploiting CVE-2019-9082 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2019-9082 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2019-9082 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit ThinkPHP installations by sending crafted requests to index.php with the s parameter set to paths like /Index/\think\app/invokefunction or captcha, abusing the function and filter parameters to execute arbitrary system commands remotely.