CVE-2023-53902

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

WebsiteBaker 2.13.3 contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files by manipulating directory path parameters. Attackers can send crafted GET requests to /admin/media/delete.php with directory traversal sequences to delete files outside the intended directory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
websitebaker	WebsiteBaker	2.13.3

References

https://websitebaker.org/pages/en/home.phpProduct
https://www.exploit-db.com/exploits/51554Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/websitebaker-directory-traversal-via-media-delete-endpointExploit, Third Party Advisory

Timeline

Published: Dec 16, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-539035.4WebsiteBaker 2.13.3 contains a stored cross-site scripting vulnerability that allows authenticated users to upload malicious SVG files with CVE-2023-539044.6Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts thr CVE-2023-539058.0ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile name CVE-2023-539064.8projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScri CVE-2023-539076.5Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to acces CVE-2023-539088.8HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based CVE-2023-539095.4WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by up CVE-2023-53919.8A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted sys CVE-2023-539105.4WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by in CVE-2023-539115.4Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to i CVE-2023-539126.2USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allows local attackers to CVE-2023-539138.8Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname fie