CVE-2023-52086: Startutorial PHP Backend For Resumable.js

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)

Affected products

• Startutorial PHP Backend For Resumable.js: version 0.1.4 only

Published 2023-12-26. Last modified 2026-06-17.