Software Repositoryproduct
https://github.com/thibaud-rohmer/PhotoShow CVE-2023-53981
HIGH
PhotoShow 3.0 Remote Code Execution via Exiftran Path Injection
Record summary
CVE-2023-53981 has a selected CVSS score of 8.6 (high); EIP currently links 1 catalogued exploit.
Description
PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through the exiftran path configuration. Attackers can exploit the ffmpeg configuration settings by base64 encoding a reverse shell command and executing it through a crafted video upload process.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 22, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
PhotoShowBrowse thibaud-rohmer / PhotoShow | CVE List | 3.0 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBPhotoShow 3.0 - Remote Code ExecutionExploitDB exploitby LSCP Responsible Disclosure LabNot analyzed1 file
References
5Researcher Disclosureproduct
https://lscp.llc/index.php/2021/07/19/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-53981 ExploitDB-51236exploit
https://www.exploit-db.com/exploits/51236 VulnCheck Advisory: PhotoShow 3.0 Remote Code Execution via Exiftran Path InjectionThird-party advisory
https://www.vulncheck.com/advisories/photoshow-remote-code-execution-via-exiftran-path-injection