Vulnerability · Published Dec 18, 2025 · Assigned by VulnCheck
CVE-2023-53942File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution
High 8.8
In plain English
A high-severity unrestricted file upload in File Thingie from leefish. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| leefish | File Thingie | 2.5.7 |
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51436 exploit
- Product GitHub Repository product
- VulnCheck Advisory: File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution third-party-advisory