CVE-2023-53922: Tinywebgallery

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.

Affected products

• Tinywebgallery Tinywebgallery: version 2.5 only

Published 2025-12-17. Last modified 2026-06-17.