CVE-2023-22953: Expressionengine

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.

Affected products

• Expressionengine Expressionengine: before 7.2.6 (fixed in 7.2.6)

Published 2023-02-09. Last modified 2026-06-17.