What’s Vulnerable › Vulnerabilities

CVE-2023-53933: Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-434

Description

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Affected products

• s9y Serendipity: 2.4.0

References

• https://docs.s9y.org/
• https://www.exploit-db.com/exploits/51372
• https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload
• https://www.exploit-db.com/exploits/51372

Get alerted when CVE-2023-53933 or the next vulnerability affects your stack