PT-2025-52523 · Dotclear · Dotclear

Mirabbas Ağalarov · Published 2025-12-19 · Updated 2025-12-22 · CVE-2023-53952

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dotclear version 2.25.3

Description Dotclear version 2.25.3 contains a remote code execution issue. Authenticated attackers can upload malicious PHP files with a .phar extension through the blog post creation interface. Uploading files containing PHP system commands allows execution of arbitrary code on the server when the uploaded file is accessed. The issue involves the ability to upload files via the blog post creation interface.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-53952

Affected Products

Dotclear

References · 11

• 🔥 https://vulncheck.com/advisories/dotclear-authenticated-remote-code-execution-via-file-upload · Exploit
• 🔥 https://exploit-db.com/exploits/51353 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53952 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53952 · Vendor Advisory
• https://t.me/CVEtracker/40315 · Telegram Post
• https://twitter.com/CveFindCom/status/2002131694040604961 · Twitter Post
• https://dotclear.org · Note
• https://twitter.com/CVEnew/status/2002466767172448757 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2002148571626270781 · Twitter Post
• https://twitter.com/TheHackerWire/status/2002137789064761831 · Twitter Post
• https://twitter.com/SecAideInfo/status/2003047269705101809 · Twitter Post