CVE-2023-53922

TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Affected

TinyWebGallery

CVSS v4.0 VULNCHECK

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.11% chance of exploitation in the next 30 days, 65th percentile

Published

2025-12-17

Updated

2026-07-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51443

Security advisories

• https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricte…
• http://www.tinywebgallery.com

References

• CVE Record
• NVD entry