eXtplorer
CVE-2023-54335
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed eXtplorer login
-
DeliverySend manipulated login request
-
ExploitBypass password authentication
-
ExecutionUpload malicious PHP file
-
ImpactExecute remote OS commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default eXtplorer 2.1.14 installations via a manipulated login request that bypasses password checks (CWE-306). The only practical prerequisites are network reachability of the eXtplorer web interface and the vulnerable 2.1.14 version; the follow-on RCE additionally relies on the file manager's built-in file-upload capability being usable post-bypass (its normal function). Limiting factors are therefore narrow: the attack is blocked only if the eXtplorer interface is not network-accessible (e.g., behind authentication proxy/VPN/IP allowlist) or the instance has been upgraded past 2.1.14. No user interaction, no prior credentials, and no non-default configuration are required. |
| Impact | Signals mostly align toward a genuinely serious, easy-to-exploit flaw but one that is NOT confirmed as widely attacked. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, score 9.3) describes a remote, low-complexity, unauthenticated authentication bypass chaining to PHP upload and remote command execution - full compromise with no prerequisites, which matches CWE-306 (missing authentication for a critical function). Publicly available exploit code (Exploit-DB 51067) lowers the barrier to opportunistic use. However, the EPSS score is only 0.41% (61st percentile), which is modest and conflicts with the trivial exploitability implied by the vector; this discrepancy most likely reflects the product's limited deployment footprint rather than any difficulty of exploitation. There is NO CISA KEV listing in the provided data, so active in-the-wild exploitation is not confirmed. Net assessment: high technical severity with a working public exploit, but real-world urgency is bounded by how exposed and widespread eXtplorer instances are - treat internet-facing eXtplorer 2.1.14 as a priority patch, while broad fleet-wide panic is not justified by the exploitation signals. |
| Exploit ScenarioDerived | An attacker locates an internet-facing eXtplorer 2.1.14 file manager and sends a manipulated login request that bypasses password authentication entirely (AV:N/AC:L/PR:N). With an authenticated session, they use the file manager to upload a malicious PHP webshell and then execute arbitrary operating-system commands on the host. A public exploit (Exploit-DB 51067) already automates this chain, so no custom tooling is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 06, 2026
Unauthenticated remote attackers can bypass authentication in eXtplorer 2.1.14 by manipulating the login request so password validation is never performed (CWE-306, missing authentication for a critical function), then abuse the file manager's own upload feature to plant PHP code and execute arbitrary commands on the server. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, base 9.3) and the independent assessment's CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector both describe full compromise requiring no credentials, no user interaction, and no non-default configuration on a network-reachable instance. Publicly available exploit code exists (Exploit-DB 51067 and a VulnCheck advisory with RCE detail), and EPSS places exploitation likelihood at roughly the 61st percentile (0.41%) - elevated compared with the average CVE but with no evidence of confirmed active exploitation (not in CISA KEV).
Earlier versions of this analysis (1)
eXtplorer allows passwordless login leading to PHP file upload and RCE.
RemediationAI
No vendor-released patch identified at time of analysis, and no fixed version is specified in the provided references, so the primary action is risk elimination rather than version upgrade: remove or decommission the eXtplorer 2.1.14 installation where it is not strictly required, and where it must stay, place the interface behind a network control (VPN, IP allowlist, or an authenticating reverse proxy) so the unauthenticated login path is unreachable from untrusted networks - the trade-off being that any legitimate remote users or integrations must be routed through that control. Because the post-bypass RCE depends on uploading executable PHP into a web-served directory, harden that path: deny PHP execution inside the eXtplorer upload/data directories (e.g., php_admin_flag engine off or an equivalent per-directory handler restriction in the web server config), and ensure the PHP process account cannot write outside intended directories; note that this blocks the specific upload-to-execute chain but does not fix the underlying authentication bypass, so a future bypass variant could still expose file read/write. Additionally, monitor web logs for anomalous login POSTs and subsequent .php writes, and apply WAF signatures for the documented manipulation of the login request in Exploit-DB 51067 (https://www.exploit-db.com/exploits/51067) while acknowledging that WAF rules are evadable and should be treated as detection, not prevention. Consult the project site (https://extplorer.net/) and the VulnCheck advisory (https://www.vulncheck.com/advisories/extplorer-authentication-bypass-remote-code-execution-rce) for any subsequently published fix before re-enabling normal internet exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
eXtplorer is a PHP-based web file manager (historically shipped as a Joomla!/Mambo component and later distributed standalone) that exposes a browser-accessible login form and, once authenticated, a full file-management surface for browsing, editing, uploading, and deleting files under the web root. The root cause is CWE-306: the login handling logic performs an insufficient authentication check, so a crafted login request satisfies the flow without a valid password - the authentication decision is effectively absent for the request path rather than merely weak. Because the application's normal function includes writing files into web-accessible directories, the bypass compounds directly into remote code execution: the attacker uploads a .php payload that the web server then executes with the privileges of the PHP process. The CPE record cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:* keys the product generically to the eXtplorer vendor/product namespace, while the advisory data (VulnCheck advisory and the standalone vendor site extplorer.net) identifies 2.1.14 as the concrete vulnerable release. No cryptographic or session-level weakness is required; the flaw is entirely in the authentication path, which is why the assessment describes no meaningful prerequisites beyond network reachability of the interface.
Know when Extplorer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated login bypass (PR:N, AV:N, AC:L) leading to PHP upload and OS command execution, yielding full confidentiality, integrity, and availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
Executive ViewAI
eXtplorer 2.1.14, a web-based file manager, contains a critical unauthenticated remote code execution vulnerability (CVE-2023-54335) that allows attackers to fully compromise affected servers without credentials or user interaction. Publicly available exploit code exists and no vendor-released patch has been identified at time of analysis, meaning any network-reachable instance is at severe risk of data theft, ransomware, and lateral movement. Leadership should treat this as an urgent containment and remediation priority.
No vendor-released patch identified at time of analysis; restrict network access to trusted sources, disable eXtplorer if not essential, deploy WAF rules to block authentication bypass and malicious uploads, and monitor logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
eXtplorer 2.1.15 is vulnerable to Insecure Permissions. Rated high severity (CVSS 8.8), this vulnerability is remotely e
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execut
Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitra
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the a
A security flaw has been discovered in soerennb eXtplorer up to 2.1.15. Rated medium severity (CVSS 5.1), this vulnerabi
Command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the us
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authenti
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remo
A reflected XSS vulnerability was discovered in the Extplorer component for Joomla. Rated medium severity (CVSS 6.1), th
Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary
eXtplorer 2.1.0b6 uses world writable permissions for the /var/lib/extplorer/ftp_tmp directory, which allows local users
GitHub PoC