PT-2025-52323 · Unknown · Easyphp Webserver

Rafael Pedrero · Published 2025-12-18 · Updated 2025-12-26 · CVE-2023-53944

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions EasyPHP Webserver version 14.1

Description A path traversal flaw exists in EasyPHP Webserver that permits unauthenticated remote users with limited privileges to access files beyond the intended document root. This is achieved by circumventing SecurityManager restrictions through crafted HTTP GET requests containing directory traversal sequences, such as /..%5c..%5c. Successful exploitation allows reading of arbitrary system files, for example, /windows/win.ini.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-53944

Affected Products

Easyphp Webserver

References · 8

• 🔥 https://vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences · Exploit
• 🔥 https://exploit-db.com/exploits/51430 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53944 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53944 · Security Note
• https://t.me/cveNotify/146903 · Telegram Post
• https://easyphp.org · Note
• https://t.me/cveNotify/146257 · Telegram Post
• https://twitter.com/CVEnew/status/2002117782532485511 · Twitter Post