Critical severity · published Dec 17, 2025
CVE-2023-53922
TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
TinyWebGallery · TinyWebGallery
2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-53922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-53922
Product
http://www.tinywebgallery.com/
Exploit
https://www.exploit-db.com/exploits/51443
Exploit
https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload
More from TinyWebGallery
7.2
CVE-2012-2931
PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file
5.4
CVE-2023-53939
TinyWebGallery v2.5 Stored Cross-Site Scripting via Folder Name Parameter
5.4
CVE-2017-16635
In TinyWebGallery v2.4, an XSS vulnerability is located in the `mkname`, `mkitem`, and `item` parameters of the `Add/Create` module
5.3
CVE-2013-2631
TinyWebGallery (TWG) 1.8.9 and earlier contains a full path disclosure vulnerability which allows remote attackers to obtain sensitive information through the parameters…
–
CVE-2012-2932
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the selitems[] parameter…