PT-2025-52321 · Unknown · File Thingie

Maurice Fielenbach · Published 2025-12-18 · Updated 2025-12-19 · CVE-2023-53942

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions File Thingie version 2.5.7

Description The software contains an authenticated file upload issue that enables remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter. The vulnerability requires minimal authentication before delivering full system command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-53942

Affected Products

File Thingie

References · 9

• 🔥 https://exploit-db.com/exploits/51436 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53942 · Security Note
• https://github.com/leefish/filethingie · Note
• https://twitter.com/CVEnew/status/2002117784545693755 · Twitter Post
• https://vulncheck.com/advisories/file-thingie-authenticated-arbitrary-file-upload-remote-code-execution · Note
• https://t.me/cveNotify/146255 · Telegram Post
• https://twitter.com/0dayPublishing/status/2001746939994353812 · Twitter Post
• https://twitter.com/CveFindCom/status/2001754185360876028 · Twitter Post