Read the docs
TI-2023-30225 Aliases CVE-2023-53942GHSA-4rrg-j6g5-6x9x

File Thingie 2.5.7 Authenticated Arbitrary File Upload Remote Code Execution

Priority HIGH 76CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00578 47th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
leefishFile Thingie2.5.7—No fix listedCNA
  • File Thingie Vendorleefish Affected 2.5.7 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:leefish:file_thingie:2.5.7:*:*:*:*:*:*:*2.5.7Vulnerableleefish
  • cpe:2.3:a:leefish:file_thingie:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·leefish

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-53942
  2. 2026-10-03 Alias added: GHSA-4rrg-j6g5-6x9x

References

Exploit 1

Other 1

  • TI-2019-15524 FileThingie 2.5.7 Arbitrary File Upload via ft2.php CVSS 4.0CRITICAL 9.3
  • TI-2026-23575 File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1MEDIUM 6.5
  • TI-2026-23574 File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1MEDIUM 6.5
  • TI-2026-23576 File Thingie 2.5.7 is vulnerable to Directory Traversal. CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences