CVE-2023-53924: Ulicms

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution through maliciously crafted avatar uploads.

Affected products

• Ulicms Ulicms: version 2023.1 only

Published 2025-12-17. Last modified 2026-06-17.