Unrated severityNVD Advisory· Published Dec 17, 2025· Updated Apr 7, 2026

TinyWebGallery v2.5 Remote Code Execution via Unrestricted File Upload

CVE-2023-53922

Description

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Affected products

Tinywebgallery/Tinywebgalleryv5
Range: 2.5

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.exploit-db.com/exploits/51443mitreexploit
www.vulncheck.com/advisories/tinywebgallery-remote-code-execution-via-unrestricted-file-uploadmitrethird-party-advisory
www.tinywebgallery.commitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000