CVE-2023-53956: Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-19 · updated 2026-06-17
Weakness: CWE-434

Description

Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on the server.

Affected products

altervista flatnux: 2021-03.25

References

http://flatnux.altervista.org/flatnux.html
https://www.exploit-db.com/exploits/51295
https://www.vulncheck.com/advisories/flatnux-authenticated-file-upload-remote-code-execution

Get alerted when CVE-2023-53956 or the next vulnerability affects your stack