CVE-2023-53876: Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG f

Routine

MEDIUM 5.4DOWNGRADE

CVE-2023-53876 is a medium-severity flaw (CVSS 5.4) affecting academy lms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature by modifying file extensions and embedding executable JavaScript code.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.2% (top 84%)
CISA exploited list	No
Weakness	CWE-434
Published	2025-12-15
Last modified	2026-06-17

Publisher (CNA): VulnCheck · Vendor: creativeitem

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-12-15 21:15 UTCPublished CVE record published
2026-06-17 06:46 UTCUpdated Record last modified

creativeitem academy lms DOWNGRADE

Affected: 6.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 6.1

1. Check installed version

apt-cache policy academy-lms || rpm -q academy-lms || academy-lms --version

2. No fixed release: DOWNGRADE to a release before 6.1 (Debian / Ubuntu)

apt-cache madison academy-lms sudo apt install academy-lms=<VERSION_BEFORE_6.1> sudo apt-mark hold academy-lms

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list academy-lms sudo dnf downgrade academy-lms-<VERSION_BEFORE_6.1> sudo dnf versionlock add academy-lms

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-53876?

academy lms: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-53876 being exploited?

CVE-2023-53876 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-53876 affect?

CVE-2023-53876 affects academy lms. Severity is medium (CVSS 5.4). Academy LMS 6.1 contains a file upload vulnerability that allows authenticated users to upload malicious SVG files with stored cross-site scripting payloads. Attackers can inject malicious scripts through the profile avatar upload feature b

How urgent is CVE-2023-53876?

Priority 28/100. Public exploit reference

Related CVEs

CVE-2025-71179 MEDIUM 6.1 DOWNGRADE Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search para
CVE-2025-56749 CRITICAL 9.4 UPGRADE Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing
CVE-2025-56748 MEDIUM 6.4 UPGRADE Creativeitem Academy LMS up to and including 5.13 uses predictable password reset tokens based on Base64 encod
CVE-2025-56747 MEDIUM 6.5 UPGRADE Creativeitem Academy LMS up to and including 5.13 contains a privilege escalation vulnerability in the Api_ins
CVE-2025-56746 LOW 2.2 UPGRADE Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authenticati

References

← Back to latest CVEs