CVE-2023-52086

Description

resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)

Category

8.1
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.10%
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
https://github.com/dilab/resumable.php/issues/34 issue tracking
https://github.com/dilab/resumable.php/pull/39/commits/d3552efd403e2d87407934477eee642836cab3b4 patch
https://github.com/dilab/resumable.php/pull/27/commits/3e3c94d0302bb399a7611b4738a5a4dd0832a926 patch
https://github.com/dilab/resumable.php/pull/39/commits/408f54dff10e48befa44d417933787232a64304b patch
https://github.com/dilab/resumable.php/commit/3c6dbf5170b01cbb712013c7d0a83f5aac45653b patch

Frequently Asked Questions

What is the severity of CVE-2023-52086?
CVE-2023-52086 has been scored as a high severity vulnerability.
How to fix CVE-2023-52086?
To fix CVE-2023-52086, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-52086 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-52086 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.