CVE-2023-53944

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

E

asyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini.

References

Link	Resource
https://www.easyphp.org/	Product
https://www.exploit-db.com/exploits/51430	Exploit
https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences	Third Party Advisory Exploit
https://www.exploit-db.com/exploits/51430	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:easyphp:webserver:14.1:*:*:*:*:*:*:*

History

26 Dec 2025, 16:55

Type	Values Removed	Values Added
CPE		cpe:2.3:a:easyphp:webserver:14.1:::::::*
First Time		Easyphp webserver Easyphp
References	~~() https://www.easyphp.org/ -~~	() https://www.easyphp.org/ - Product
References	~~() https://www.exploit-db.com/exploits/51430 -~~	() https://www.exploit-db.com/exploits/51430 - Exploit
References	~~() https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences -~~	() https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences - Third Party Advisory, Exploit

19 Dec 2025, 18:00

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-18 20:15

Updated : 2025-12-26 16:55

NVD link : CVE-2023-53944

Mitre link : CVE-2023-53944

CVE.ORG link : CVE-2023-53944

JSON object : View

Products Affected

webserver

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-53944", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-12-18T20:15:53.097", "references": [{"url": "https://www.easyphp.org/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/51430", "tags": ["Exploit"], "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/easyphp-webserver-path-traversal-via-directory-traversal-sequences", "tags": ["Third Party Advisory", "Exploit"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/51430", "tags": ["Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "EasyPHP Webserver 14.1 contains a path traversal vulnerability that allows remote users with low privileges to access files outside the document root by bypassing SecurityManager restrictions. Attackers can send GET requests with encoded directory traversal sequences like /..%5c..%5c to read system files such as /windows/win.ini."}], "lastModified": "2025-12-26T16:55:30.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:easyphp:webserver:14.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25E85EE7-0612-4478-A212-5E5F90944A3D"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}