CVE-2023-53772 MiniDVBLinux 5.4 Arbitrary File Read Vulnerability via About Page
Attackers can read arbitrary system files on MiniDVBLinux devices by manipulating the file parameter in the about page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53772?
CVE-2023-53772 is a high-severity path traversal vulnerability in MiniDVBLinux, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MiniDVBLinux 5.4 contains an arbitrary file disclosure vulnerability that allows attackers to read sensitive system files through the 'file' GET parameter. Attackers can exploit the about page by supplying file paths to disclose arbitrary file contents on the affected device.
Weakness: CWE-22
Which versions are affected by CVE-2023-53772?
It affects 1 product.
Products include Minidvblinux Minidvblinux.
How do I fix CVE-2023-53772?
No fix has been published for CVE-2023-53772 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-53772 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53772 exists.
Other vulnerabilities in MiniDVBLinux
- CVE-2022-50691 MiniDVBLinux 5.4 Remote Root Command Execution via commands.sh
- CVE-2023-53771 MiniDVBLinux 5.4 Unauthenticated Root Password Change via System Setup
- CVE-2025-25038 MiniDVBLinux Root Command Injection
- CVE-2023-53770 MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint
- CVE-2023-53773 MiniDVBLinux 5.4 Unauthenticated Live Stream Disclosure via tv_action.sh
Sources
Also known as GHSA-ppvc-j5f4-q5rv.