TI-2022-19439 Aliases CVE-2022-40849 GHSA-m9mf-rqx6-2xpc

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS).

MEDIUM 58CWE-79Published 2022-12-01 · Updated 2025-04-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's PHP session token (PHPSESSID).

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00427 37th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed thinkcmf/thinkcmf (Packagist): 6.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	thinkcmf/thinkcmf (Packagist)	before 6.0.8	6.0.8	Patch available	GHSA-m9mf-rqx6-2xpc

— Vendor— Affected all versions Fixed in — No fix listed CNA
thinkcmf/thinkcmf (Packagist) Vendor— Affected before 6.0.8 Fixed in 6.0.8 Patch available GHSA-m9mf-rqx6-2xpc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:thinkcmf:thinkcmf:6.0.7:::::::*	6.0.7	Vulnerable	ThinkCMF

cpe:2.3:a:thinkcmf:thinkcmf:6.0.7:*:*:*:*:*:*:* Versions 6.0.7 Vulnerable ·ThinkCMF

Remediation

Fix · GHSA-m9mf-rqx6-2xpc thinkcmf/thinkcmf (Packagist) Fixed in 6.0.8 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-40849
2026-10-03 Alias added: GHSA-m9mf-rqx6-2xpc

References

Exploit 1

https://github.com/thinkcmf/thinkcmf/issues/737

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-40849

Other 3

TI-2024-20894 ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php. CVSS 3.1CRITICAL 9.8
TI-2022-19215 ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability… CVSS 3.1HIGH 8.8
TI-2020-15874 Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5… CVSS 3.1MEDIUM 5.4
TI-2020-13886 An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. CVSS 3.1CRITICAL 9.8
TI-2019-05352 ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the… CVSS 3.0HIGH 8.8
TI-2019-04756 app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers… CVSS 3.0CRITICAL 9.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences