CVE-2023-53942
Published: 18 December 2025
Summary
CVE-2023-53942 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Leefish File Thingie. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
File Thingie version 2.5.7 is affected by CVE-2023-53942, an authenticated file upload vulnerability classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw enables remote attackers to upload malicious PHP zip archives directly to the web server. Once uploaded, attackers can unzip the archive and leverage a crafted PHP script with a command parameter to execute arbitrary system commands, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Attackers require low-privilege authenticated access (PR:L) to exploit this vulnerability over the network with no user interaction. By crafting a custom PHP payload within a zip archive, they can upload it via the vulnerable file upload functionality, extract it on the server, and invoke remote code execution (RCE) through the command parameter in the PHP script. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially leading to full server compromise.
Advisories and proof-of-concept exploits detail the issue, including a public exploit at Exploit-DB (ID 51436) and a Vulncheck advisory on the authenticated arbitrary file upload leading to RCE. The project's GitHub repository at https://github.com/leefish/filethingie provides further context on the software. No specific patch details are outlined in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204359
Vulnerability details
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands…
more
through a crafted PHP script with a command parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated unrestricted file upload enables exploitation of public-facing web application (T1190) to deploy and execute a PHP web shell for arbitrary command execution (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted authenticated file upload flaw in File Thingie 2.5.7, preventing upload and execution of malicious PHP zip archives.
Validates uploaded zip files and their contents to reject malicious PHP payloads before they reach the web server.
Scans and eradicates malicious PHP code from uploaded archives, blocking arbitrary command execution via crafted scripts.