CVE-2023-53871 is a critical unrestricted file upload flaw (CVSS 9.8) in Soosyze CMS 2.0.0. The upload logic accepts HTML files with embedded PHP code, which can expose file paths and let a PHP script run on the server. No fixed version is confirmed, so check the project and restrict uploads.
What's affected
The CVE record and VulnCheck list Soosyze 2.0.0. The description says the broken upload mechanism lets attackers upload arbitrary HTML files with embedded PHP code, and potentially view sensitive file paths and execute PHP scripts on the server. The record links a public exploit listing.
The Soosyze site shows v2.0.0 as the current download at the time of fetching, and the project is hosted on GitHub. I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release.
How to check if you're exposed
Find the version in the admin area of the site or in the project files. If you run 2.0.0, you are in the stated range.
Then look at the web server. An uploaded file can only do damage if the server will run it. Check whether the upload directory is served as static files only, or whether PHP execution is enabled there:
ls -la /var/www/site/app/files
Adjust the path to your install. Look for files you did not upload, especially files with a php extension or HTML files with unusual size.
If your site accepts uploads from visitors or low privilege users, the exposure is wider than if only administrators can upload.
What to do now
- Confirm the version of every Soosyze site.
- Check the project's GitHub repository and site for a release newer than 2.0.0, and apply it.
- Configure the web server so the upload directory cannot execute PHP, and only serves the file types you expect.
- Limit who can upload files, and review existing files in the upload directory.
- Take regular backups, and keep a known clean copy to compare against.
Why it matters
Unrestricted upload of a dangerous file type (CWE-434) means an application accepts a file and stores it somewhere the server can execute it, without checking what kind of file it is. A web server that runs PHP in the upload folder will execute a PHP file placed there as if the site owner wrote it.
The NVD score is 9.8 with no privileges required. VulnCheck scores it lower with its newer vector, at 6.9, so the severity you assign should depend on who can upload to your site. The fix in code is to validate type and content on the server and store uploads outside the web root. The record does not describe attacks in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Can I block this without a patch?
You can reduce the risk by disabling script execution in the upload folder and limiting who can upload, but you still need the fix when it exists.
Which versions are affected?
The record lists Soosyze 2.0.0.
Sources
Last reviewed: 19 October 2026.
