CVE-2023-53922 TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

What is CVE-2023-53922?

CVE-2023-53922 is a critical vulnerability in TinyWebGallery, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Weakness: CWE-434

Which versions are affected by CVE-2023-53922?

It affects 1 product.

Products include Tinywebgallery Tinywebgallery.

How do I fix CVE-2023-53922?

No fix has been published for CVE-2023-53922 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-53922 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53922 exists.

Other vulnerabilities in TinyWebGallery

• CVE-2012-5347 Command injection in n/a High 7.5
• CVE-2006-4166 Code injection in n/a High 7.5
• CVE-2012-2931 Code injection in n/a High 7.2
• CVE-2012-2930 Cross-site request forgery in n/a Medium 6.8
• CVE-2017-16635 Cross-site scripting in n/a Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-43xj-26f5-3q3h.