CVE-2023-53933: s9y Serendipity

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Affected products

• s9y Serendipity: version 2.4.0 only

Published 2025-12-17. Last modified 2026-06-17.