ThinkCMF - RCE (CVE-2020-20601)

CVE-2020-20601 is a critical vulnerability in ThinkCMF X2.2.2 and earlier that allows remote attackers to execute arbitrary code by sending specially crafted packets. This flaw could be exploited to gain full control over the affected system, leading to data theft, system compromise, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2020-20601 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2020-20601 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2020-20601 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit ThinkCMF by sending requests to /index.php with parameters such as g=g&m=Door&a=index&content= containing injected PHP code, enabling remote code execution. This pattern targets endpoints where the content parameter is processed without proper sanitization.