CVE-2023-53942 File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

Critical 9.4 Published 18 Dec 2025 Updated 7 Apr 2026

Authenticated attackers can upload malicious PHP archives to File Thingie to execute arbitrary system commands on the web server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-53942?

CVE-2023-53942 is a critical vulnerability in leefish File Thingie, published on 18 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.

Weakness: CWE-434

Which versions are affected by CVE-2023-53942?

It affects 1 product.

Products include Leefish File Thingie.

How do I fix CVE-2023-53942?

No fix has been published for CVE-2023-53942 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-53942 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53942 exists.

Sources

Also known as GHSA-4rrg-j6g5-6x9x.