CVE-2023-53933
Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 17, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 16, 2025
Description
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Serendipitys9y |
|
References
- ExploitDB-51372exploit
- Official Product Homepageproduct
- VulnCheck Advisory: Serendipity 2.4.0 Authenticated Remote Code Execution via File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.