CVE-2023-53922
CriticalSummary
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
Risk Assessment
This vulnerability could lead to complete server compromise, posing a critical threat to system confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately update the system to a patched version and to restrict file upload permissions.
Original NVD description (English source)
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.