{"id":"CVE-2023-53922","state":"PUBLISHED","title":"TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload","description":"TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.","publishedAt":"2025-12-17T22:44:53.801Z","updatedAt":"2026-07-15T01:24:55.680Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["TinyWebGallery TinyWebGallery"],"affected":[{"vendor":"TinyWebGallery","product":"TinyWebGallery","versions":[{"version":"2.5","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/51443","http://www.tinywebgallery.com/","https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53922.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53922","state":"PUBLISHED","datePublished":"2025-12-17T22:44:53.801Z","dateUpdated":"2026-07-15T01:24:55.680Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-16T19:22:09.995Z"},"containers":{"cna":{"title":"TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload","descriptions":[{"lang":"en","value":"TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL."}],"affected":[{"vendor":"TinyWebGallery","product":"TinyWebGallery","versions":[{"version":"2.5","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/51443","name":"ExploitDB-51443","tags":["exploit"]},{"url":"http://www.tinywebgallery.com/","name":"Official Product Webpage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload","name":"VulnCheck Advisory: TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-15T01:24:55.680Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tinywebgallery:tinywebgallery:2.5:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Mirabbas Ağalarov","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2023-05-23T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.exploit-db.com/exploits/51443","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-18T18:48:59.101682Z","id":"CVE-2023-53922","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-18T18:54:43.367Z"}}]}}}