CVE-2023-54335 eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)
Attackers can bypass authentication in eXtplorer to upload malicious files and execute remote code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-54335?
CVE-2023-54335 is a critical authentication bypass vulnerability in eXtplorer, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
Weakness: CWE-306
Which versions are affected by CVE-2023-54335?
It affects 1 product.
Products include Extplorer Extplorer.
How do I fix CVE-2023-54335?
No fix has been published for CVE-2023-54335 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-54335 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-54335 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in eXtplorer
Sources
Also known as GHSA-pf5x-rfqf-hx7w, UBUNTU-CVE-2023-54335.