{"id":"CVE-2023-53956","state":"PUBLISHED","title":"Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution","description":"Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on the server.","publishedAt":"2025-12-19T21:05:52.196Z","updatedAt":"2026-04-07T14:08:11.144Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["altervista flatnux"],"affected":[{"vendor":"altervista","product":"flatnux","versions":[{"version":"2021-03.25","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/51295","http://flatnux.altervista.org/flatnux.html","https://www.vulncheck.com/advisories/flatnux-authenticated-file-upload-remote-code-execution"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53956.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53956","state":"PUBLISHED","datePublished":"2025-12-19T21:05:52.196Z","dateUpdated":"2026-04-07T14:08:11.144Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2025-12-19T14:03:57.723Z"},"containers":{"cna":{"title":"Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution","descriptions":[{"lang":"en","value":"Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on the server."}],"affected":[{"vendor":"altervista","product":"flatnux","versions":[{"version":"2021-03.25","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/51295","name":"ExploitDB-51295","tags":["exploit"]},{"url":"http://flatnux.altervista.org/flatnux.html","name":"Official Product Homepage","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/flatnux-authenticated-file-upload-remote-code-execution","name":"VulnCheck Advisory: Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","lang":"en","description":"Unrestricted Upload of File with Dangerous Type","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-04-07T14:08:11.144Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:flatnux:flatnux:2021-03.25:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"Ömer Hasan Durmuş","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2023-04-06T00:00:00.000Z"},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-19T21:51:29.105740Z","id":"CVE-2023-53956","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-19T21:51:58.606Z"}}]}}}