Flatnux 2021-03.25 Authenticated File Upload Remote Code Execution

Advisories

severity: high
date: December 19, 2025
Affecting: flatnux 2021-03.25
CVE: CVE-2023-53956
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: ExploitDB-51295
Official Product Homepage
Credit: Ömer Hasan Durmuş
Description: Flatnux 2021-03.25 contains an authenticated file upload vulnerability that allows administrative users to upload arbitrary PHP files through the file manager. Attackers with admin credentials can upload malicious PHP scripts to the web root directory, enabling remote code execution on the server.