CVE-2023-52086

HIGH 8.1CVE-2023-52086 · Published 26/12/2023 · updated 17/06/2026

In short

CVE-2023-52086 is a HIGH (CVSS 8.1) vulnerability affecting php backend for resumable.js (startutorial).
Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
php backend for resumable.js startutorial	`= 0.1.4`	No fix yet

Description

resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn't been possible with the code available in GitHub in recent years, however.)

References

dilab/resumable.php commit 3c6dbf5 · Patch
dilab/resumable.php · Issue Tracking
dilab/resumable.php#27 · Patch
dilab/resumable.php#39 · Patch
dilab/resumable.php#39 · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free