CVE-2023-53950

InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulation

State: Published
Severity: 9.3 Critical
Published: Dec 19, 2025
Updated: May 14, 2026
Reserved: Dec 16, 2025

Description

InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file extension restrictions through filename manipulation. Attackers can upload malicious ASP shells by using null byte techniques and alternate file extensions to circumvent upload controls in the asset manager.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WYSIWYG Editorinnovastudio	5.4 and earlierAffected

References

ExploitDB-51362exploit
Official Vendor Homepageproduct
VulnCheck Advisory: InnovaStudio WYSIWYG Editor 5.4 Unrestricted File Upload via Filename Manipulationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.