PT-2025-51960 · Unknown · Tinywebgallery

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-24 · CVE-2023-53922

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TinyWebGallery version 2.5

Description TinyWebGallery version 2.5 contains a remote code execution issue in the admin upload functionality. An unauthenticated attacker can upload malicious PHP files, specifically .phar files, to execute arbitrary code on the server. This is achieved by accessing the URL of the uploaded file. The vulnerability bypasses security controls, presenting no barriers to exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-53922

Affected Products

Tinywebgallery

References · 8

• 🔥 https://vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-upload · Exploit
• 🔥 https://exploit-db.com/exploits/51443 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53922 · Security Note
• https://twitter.com/CVEnew/status/2002487784561652093 · Twitter Post
• https://twitter.com/0dayPublishing/status/2001426062727688377 · Twitter Post
• https://t.me/cveNotify/146772 · Telegram Post
• http://tinywebgallery.com · Note