Vulnerability · Published Dec 22, 2025 · Assigned by VulnCheck
CVE-2023-53971WebTareas 2.4 Authenticated Remote Code Execution via File Upload
High 8.8
In plain English
A high-severity unrestricted file upload in WebTareas from luiswang. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 58.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51089 exploit
- WebTareas Project Homepage product
- VulnCheck Advisory: WebTareas 2.4 Authenticated Remote Code Execution via File Upload third-party-advisory