CVE-2023-53933

8.7 highEPSS 1.0%

High (8.7) in s9y serendipity. EPSS 1.0% chance of exploitation in the next 30 days.

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-12-17
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

s9y:serendipity

References

https://docs.s9y.org/
https://www.exploit-db.com/exploits/51372
https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload
https://www.exploit-db.com/exploits/51372

Check your stack JSON