ThinkCMF - RCE (CVE-2020-20601)

CVE-2020-20601 is a critical vulnerability in ThinkCMF X2.2.2 and earlier that allows remote attackers to execute arbitrary code by sending specially crafted packets. This flaw could be exploited to gain full control over the affected system, leading to data theft, system compromise, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

CrowdSec network observations suggest that most exploitation of CVE-2020-20601 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2020-20601 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2020-20601 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit ThinkCMF by sending requests to /index.php with parameters such as g=g&m=Door&a=index&content= containing injected PHP code, enabling remote code execution. This pattern targets endpoints where the content parameter is processed without proper sanitization.