CVE-2023-53942

File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

CVSS 9.4 CRITICALEPSS 0.5%CWE-434

Vexday Risk Score

28Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 9.4EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

18 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Produtos afetados

leefish · File Thingie

Referências

https://github.com/leefish/filethingie https://www.exploit-db.com/exploits/51436 https://www.vulncheck.com/advisories/file-thingie-authenticated-arbitrary-file-upload-remote-code-execution