CVE-2023-53952
Published: 19 December 2025
Description
Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that execute when the uploaded file…
more
is accessed, enabling arbitrary code execution on the server.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and patching of the Dotclear file upload flaw to prevent authenticated RCE via malicious .phar uploads.
Mandates input validation at the blog post creation interface to reject malicious PHP files with .phar extensions before upload.
Deploys malicious code protection mechanisms to scan and block executable PHP payloads in uploaded files at system boundaries and storage.
Security SummaryAI
CVE-2023-53952 is a remote code execution vulnerability affecting Dotclear version 2.25.3, an open-source blog publishing platform. The flaw arises in the blog post creation interface, where authenticated attackers can upload malicious PHP files disguised with a .phar extension. These files can embed PHP system commands that execute arbitrarily when the uploaded file is accessed on the server.
The vulnerability requires low-privilege authentication (PR:L) and can be exploited remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), resulting in a CVSS v3.1 base score of 8.8 (high severity: C:H/I:H/A:H; CWE-434). An attacker with valid credentials, such as a registered blog contributor, can leverage the upload feature to plant executable payloads, achieving full arbitrary code execution on the server upon file access and potentially compromising the entire hosting environment.
Mitigation details are available in vendor and security advisories, including the official Dotclear site at https://dotclear.org/, a proof-of-concept exploit at https://www.exploit-db.com/exploits/51353, and a dedicated advisory from Vulncheck at https://www.vulncheck.com/advisories/dotclear-authenticated-remote-code-execution-via-file-upload. Practitioners should consult these resources for patching instructions, as the vulnerability was published on 2025-12-19. A public exploit exists, underscoring the need for immediate upgrades in affected deployments.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows authenticated remote code execution via uploading malicious PHP files disguised as .phar in a public-facing web application, directly mapping to Exploit Public-Facing Application (T1190) and Web Shell (T1100).