high8.8
CVE-2023-53942
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server.
Impact
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Leefish | File Thingie | Version 2.5.7 |