CVE-2023-53888: Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation

Published Dec 15, 2025

Updated

Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.

Affected Software

2 affected components

Zomplog Zomplog

Zomp Zomplog=3.9

Event History

Dec 15, 2025

CVE Published

via MITRE·08:28 PM

Data Sourced

via MITRE·08:28 PM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-53888?

CVE-2023-53888 is considered a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2023-53888?

To fix CVE-2023-53888, you should update Zomplog to the latest version that addresses this vulnerability.

What type of attack is associated with CVE-2023-53888?

CVE-2023-53888 involves a remote code execution attack that allows authenticated users to execute arbitrary PHP code.

Who is affected by CVE-2023-53888?

CVE-2023-53888 affects all versions of Zomplog up to 3.9 that have not been patched.

What can attackers do with CVE-2023-53888?

Attackers can upload malicious files, rename them to PHP, and execute system commands leading to full system compromise.