CVE-2023-53933 Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload
Authenticated attackers can upload malicious PHP files to execute arbitrary commands on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53933?
CVE-2023-53933 is a high-severity vulnerability in S9y Serendipity, published on 17 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Weakness: CWE-434
Which versions are affected by CVE-2023-53933?
It affects 1 product.
Products include S9y Serendipity.
How do I fix CVE-2023-53933?
No fix has been published for CVE-2023-53933 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-53933 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53933 exists.
Other vulnerabilities in S9y Serendipity
Sources
Also known as GHSA-87vx-4xf9-32hg.