ThinkCMF - RCE (CVE-2020-20601)

CVE-2020-20601 is a critical vulnerability in ThinkCMF X2.2.2 and earlier that allows remote attackers to execute arbitrary code by sending specially crafted packets. This flaw could be exploited to gain full control over the affected system, leading to data theft, system compromise, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-20601 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2020-20601 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit ThinkCMF by sending requests to /index.php with parameters such as g=g&m=Door&a=index&content= containing injected PHP code, enabling remote code execution. This pattern targets endpoints where the content parameter is processed without proper sanitization.