CVE-2023-53876 Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings
Authenticated attackers can upload malicious SVG files with XSS payloads via profile settings, leading to script execution and potential data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-53876?
CVE-2023-53876 is a medium-severity vulnerability in Creativeitem Academy LMS, published on 15 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.
Weakness: CWE-434
Which versions are affected by CVE-2023-53876?
It affects 1 product.
Products include Creativeitem Academy Lms.
How do I fix CVE-2023-53876?
No fix has been published for CVE-2023-53876 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-53876 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53876 exists.
Other vulnerabilities in Creativeitem Academy LMS
Sources
Also known as GHSA-6gcc-4rgq-w22g.