CVE-2023-53956

HighPublic PoC

Published: 19 December 2025

Published

19 December 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0066 46.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-53956 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Altervista (inferred from references). Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2023-53956 is an authenticated file upload vulnerability in Flatnux version 2021-03.25, specifically within its file manager component. This flaw allows administrative users to upload arbitrary PHP files directly to the web root directory. Successful exploitation enables attackers to deploy malicious PHP scripts, resulting in remote code execution (RCE) on the affected server. The vulnerability is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-434 (Unrestricted Upload of File with Dangerous Type).

Attackers require administrative credentials to exploit this vulnerability, which has network accessibility, low attack complexity, and no user interaction. Once authenticated as an admin, an attacker can leverage the file manager to upload a malicious PHP file to the web root, subsequently executing arbitrary code on the server. This grants high-impact confidentiality, integrity, and availability compromises, potentially allowing full server takeover.

Advisories and references, including those from Vulncheck and a proof-of-concept on Exploit-DB, detail the vulnerability and exploitation steps. The official Flatnux site is also referenced, though no specific patches or mitigation guidance is outlined in the available information. Security practitioners should restrict admin access and monitor file uploads in affected Flatnux deployments.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-204594

Vulnerability details

Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on…

the server.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Authenticated file upload vulnerability in web application file manager enables exploitation of public-facing application (T1190) to upload and execute arbitrary PHP webshells (T1100) for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0