VULNERABILITY INTELLIGENCE

CVE-2023-53922

CVSS score9.8 CRITICAL

EPSS probability1.11%

CISA KEVNot currently listed

Published2025-12-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Weakness classification

disclosure@vulncheck.com: CWE-434

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory, VDB Entry