CVE-2023-53933

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-53933

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53933.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-53933

Published

2025-12-17T22:44:59.632Z

Modified

2026-07-08T08:05:28.582203481Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Serendipity 2.4.0 Authenticated Remote Code Execution via File Upload

Details

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53933.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-434"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.4.0"
                },
                {
                    "last_affected": "2.4.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/s9y/serendipity

Affected ranges

Type

GIT

Repo

https://github.com/s9y/serendipity

Events

Introduced

4abf02c1a382c416c87e0848201242a7855a85db

Last affected

4abf02c1a382c416c87e0848201242a7855a85db

Database specific

{
    "cpe": "cpe:2.3:a:s9y:serendipity:2.4.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.4.0-NA"
        },
        {
            "last_affected": "2.4.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.4.0

2.4.0-NA

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53933.json"