CVE-2023-53944

7.1 highEPSS 1.0%

High (7.1) in easyphp webserver. EPSS 1.0% chance of exploitation in the next 30 days.

EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2025-12-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

easyphp:webserver

References

https://www.easyphp.org/
https://www.exploit-db.com/exploits/51430
https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences
https://www.exploit-db.com/exploits/51430

Check your stack JSON