CVE-2023-53956
Authenticated File Upload in Flatnux Allows Remote Code Execution
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| flatnux | flatnux | 2021-03.25 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2023-53956 is an authenticated file upload vulnerability in Flatnux version 2021-03.25. It allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, which enables them to execute arbitrary code remotely on the server. [2, 3]
How can this vulnerability impact me? :
This vulnerability can have a severe impact as it allows attackers with administrative access to execute arbitrary PHP code on the server remotely. This can lead to full compromise of the affected server, including unauthorized access to sensitive data, modification or deletion of data, and disruption of services. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for unauthorized or suspicious PHP files uploaded via the Flatnux file manager, especially in the web root directory. Since exploitation involves an authenticated POST request to /flatnux/filemanager.php with parameters like mode=t and filemanager_editor=ckeditor4, monitoring web server logs for such requests or unusual file uploads can help detect exploitation attempts. Additionally, verifying the presence of unexpected PHP files such as info.php or other uploaded scripts in the web root directory is recommended. Specific commands could include using web server log analysis tools or commands like 'grep' to search for POST requests to /flatnux/filemanager.php or to find recently created PHP files in the web root, for example: `grep 'POST /flatnux/filemanager.php' /var/log/apache2/access.log` and `find /var/www/html -name '*.php' -mtime -7` to find PHP files modified or created in the last 7 days. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting administrative access to trusted users only, as the vulnerability requires admin credentials. Disable or restrict the file upload functionality in the Flatnux file manager if possible. Monitor and remove any suspicious PHP files uploaded to the web root directory. Applying patches or updating Flatnux to a version that fixes this vulnerability is recommended once available. Additionally, implementing web application firewall (WAF) rules to block unauthorized file uploads and monitoring for unusual POST requests to /flatnux/filemanager.php can help mitigate exploitation. [3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.