CVE-2023-53868

HighPublic PoC

Published: 15 December 2025

Published

15 December 2025

Modified

18 December 2025

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0050 66.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-53868 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Coppermine-Gallery Coppermine Photo Gallery. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2023-53868 is a remote code execution vulnerability in Coppermine Gallery version 1.6.25. The flaw resides in the plugin manager component, which permits authenticated attackers to upload malicious PHP files packaged within zipped archives directly to the plugin directory.

Attackers require low-privilege authenticated access (PR:L) to exploit this over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). By uploading a ZIP containing a PHP script with arbitrary system commands and then accessing the uploaded plugin script via the web interface, they can achieve remote code execution with high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), as reflected in the CVSS v3.1 base score of 8.8. The issue stems from CWE-434 (Unrestricted Upload of File with Dangerous Type).

Advisories such as the VulnCheck report and public proof-of-concept exploits on Exploit-DB (ID 51738) detail the plugin upload mechanism enabling this RCE. The Coppermine Gallery website is preserved via web archive, with no patch details specified in the CVE information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-203438

Vulnerability details

Coppermine Gallery 1.6.25 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the plugin manager. Attackers can upload a zipped PHP file with system commands to the plugin directory and execute arbitrary code…

by accessing the uploaded plugin script.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

CVE enables exploitation of public-facing web application via unrestricted file upload (T1190), facilitating deployment and execution of web shells (T1100) for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0