CVE-2023-53942

HighPublic PoC

Published: 18 December 2025

Published

18 December 2025

Modified

31 December 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0010 27.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-53942 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Leefish File Thingie. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the unrestricted authenticated file upload flaw in File Thingie 2.5.7, preventing upload and execution of malicious PHP zip archives.

SI-10 Information Input Validation good match

prevent

Validates uploaded zip files and their contents to reject malicious PHP payloads before they reach the web server.

SI-3 Malicious Code Protection good match

preventdetect

Scans and eradicates malicious PHP code from uploaded archives, blocking arbitrary command execution via crafted scripts.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Authenticated unrestricted file upload enables exploitation of public-facing web application (T1190) to deploy and execute a PHP web shell for arbitrary command execution (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands…

through a crafted PHP script with a command parameter.

Deeper analysisAI

File Thingie version 2.5.7 is affected by CVE-2023-53942, an authenticated file upload vulnerability classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The flaw enables remote attackers to upload malicious PHP zip archives directly to the web server. Once uploaded, attackers can unzip the archive and leverage a crafted PHP script with a command parameter to execute arbitrary system commands, earning a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Attackers require low-privilege authenticated access (PR:L) to exploit this vulnerability over the network with no user interaction. By crafting a custom PHP payload within a zip archive, they can upload it via the vulnerable file upload functionality, extract it on the server, and invoke remote code execution (RCE) through the command parameter in the PHP script. Successful exploitation grants high confidentiality, integrity, and availability impacts, potentially leading to full server compromise.

Advisories and proof-of-concept exploits detail the issue, including a public exploit at Exploit-DB (ID 51436) and a Vulncheck advisory on the authenticated arbitrary file upload leading to RCE. The project's GitHub repository at https://github.com/leefish/filethingie provides further context on the software. No specific patch details are outlined in the available information.