CVE-2023-53942

9.4 criticalEPSS 0.6%

Critical (9.4) in leefish file thingie. EPSS 0.6% chance of exploitation in the next 30 days.

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2025-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

leefish:file_thingie

References

https://github.com/leefish/filethingie
https://www.exploit-db.com/exploits/51436
https://www.vulncheck.com/advisories/file-thingie-authenticated-arbitrary-file-upload-remote-code-execution
https://www.exploit-db.com/exploits/51436

Check your stack JSON