CVE-2023-53922 | TinyWebGallery v2.5 contains a remote code execution vulnera… | CVSS 9.8 CRITICAL

Description

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Metadata

CVE ID: CVE-2023-53922
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-16 19:22 UTC
Published: 2025-12-17 22:44 UTC
Last updated: 2026-07-15 01:24 UTC
Primary CWE: CWE-434
Unrestricted Upload of File with Dangerous Type
Vendor / Product: TinyWebGallery / TinyWebGallery
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
TinyWebGallery	TinyWebGallery	—	2.5

Weakness (CWE)

CWE	Source	Description
CWE-434	cna	Unrestricted Upload of File with Dangerous Type

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (3)

ExploitDB-51443 https://www.exploit-db.com/exploits/51443
Official Product Webpage http://www.tinywebgallery.com/
VulnCheck Advisory: TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload