Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-53871: Soosyze 2.0.0 lets attackers upload harmful files
CVE-2023-53871 · published 10 months ago
Summary
The file‑upload feature in Soosyze version 2.0.0 does not properly check what is being uploaded, so an attacker can place HTML pages that contain hidden PHP code on the server. This could let them see internal file locations and run their own commands on the web server. Apply the vendor's update or patch, and enforce strict file‑type validation and server‑side restrictions on uploads.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| soosyze | soosyze |
2.0.0 cpe:2.3:a:soosyze:soosyze:2.0.0:*:*:*:*:*:*:* |
Original advisory text
Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic
Soosyze 2.0.0 contains a file upload vulnerability that allows attackers to upload arbitrary HTML files with embedded PHP code to the application. Attackers can exploit the broken file upload mechanism to potentially view sensitive file paths and execute malicious PHP scripts on the server.
References
- https://soosyze.com/ URL
- https://www.vulncheck.com/advisories/soosyze-unrestricted-file-upload-via-broken... Vendor Advisory
- https://github.com/soosyze/soosyze Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53871... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-53871 Vendor Advisory
- https://www.exploit-db.com/exploits/51718 Exploit
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-434Unrestricted File Upload
Timeline
Published15 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta