What’s Vulnerable › Vulnerabilities

CVE-2023-53922: TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-434

Description

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Affected products

• TinyWebGallery: 2.5

References

• http://www.tinywebgallery.com/
• https://www.exploit-db.com/exploits/51443
• https://www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload
• https://www.exploit-db.com/exploits/51443

Get alerted when CVE-2023-53922 or the next vulnerability affects your stack