CVE-2023-53922

critical · 9.3

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

9.3

CVSS

1.1%

EPSS (exploit prob.)

64th

EPSS percentile

2025-12-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
tinywebgallery	tinywebgallery	2.5

Check a specific version with /api/v1/cve/match.

References

http://www.tinywebgallery.com/
https://www.exploit-db.com/exploits/51443
https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload
https://www.exploit-db.com/exploits/51443

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-53922