Unrated severityNVD Advisory· Published Dec 22, 2025· Updated Apr 7, 2026

WebTareas 2.4 Authenticated Remote Code Execution via File Upload

CVE-2023-53971

Description

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.

Affected products

webTareas/webTareasllm-fuzzy
Range: =2.4
luiswang/WebTareasv5
Range: 2.4

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.exploit-db.com/exploits/51089mitreexploit
www.vulncheck.com/advisories/webtareas-authenticated-remote-code-execution-via-file-uploadmitrethird-party-advisory
sourceforge.net/projects/webtareas/mitreproduct

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000