CVE-2023-53959
Published: 19 December 2025
Description
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve…
more
remote code execution when the application launches.
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through vendor patching directly eliminates the DLL hijacking vulnerability in FileZilla Client 3.63.1, preventing exploitation.
Requiring digital signatures for system components like TextShaping.dll prevents the application from loading attacker-placed malicious unsigned DLLs.
Integrity verification mechanisms detect unauthorized changes to application DLLs, blocking or alerting on the placement of malicious TextShaping.dll.
Security SummaryAI
CVE-2023-53959 is a DLL hijacking vulnerability (CWE-427) in FileZilla Client version 3.63.1. The flaw occurs because the application attempts to load a missing TextShaping.dll from its directory, enabling attackers to place a malicious version of this DLL in the application directory to execute arbitrary code upon launch.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely with low complexity, no privileges, and no user interaction. Attackers can generate a reverse shell payload using msfvenom, replace the missing DLL with it, and achieve remote code execution when a user launches the affected FileZilla Client.
Advisories and references, including those from Vulncheck (vulncheck.com/advisories/filezilla-client-dll-hijacking-via-missing-textshapingdll) and a proof-of-concept exploit on Exploit-DB (exploit-db.com/exploits/51267), detail the issue, while the FileZilla project site (filezilla-project.org) provides relevant updates for practitioners to review.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability involves DLL hijacking via a missing TextShaping.dll in the application directory and untrusted search path (CWE-427), directly enabling DLL Search Order Hijacking (T1038), DLL Side-Loading (T1073, T1574.002) for arbitrary code execution upon application launch.