Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

FileZilla Client 3.63.1 - Malicious DLL Execution Through Directory Hijacking

CVE-2023-53959 · published 10 months ago
Summary

A security risk exists in FileZilla Client 3.63.1 that allows attackers to execute unauthorized code by placing a malicious file in the application's directory. This can happen when the software runs, allowing the attacker to take control of the system. To protect yourself, update to the latest version or remove any suspicious files from the application directory.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Ubuntu:16.04:LTS canonical filezilla All versions
Original advisory text
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can gener...
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-427Uncontrolled Search Path Element
Timeline
Published19 Dec 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2023-53959 · NVD
UBUNTU-CVE-2023-53959 · OSV
Track software like this
Free during beta