CVE-2023-22953: 
Expression Engine vulnerability analysis and mitigation

In ExpressionEngine before version 7.2.6, a critical remote code execution vulnerability (CVE-2023-22953) was discovered that could be exploited by authenticated Control Panel users. The vulnerability was identified and disclosed in January 2023 (MITRE CVE).

The vulnerability exists in the /cp/addons/settings/filepicker endpoint and can be exploited through a PHP Object Injection attack by sending a serialized malicious object in the exp_viewtype cookie. The attack leverages the Adapter class to construct a gadget chain that enables writing PHP files into the default app directory (GitHub POC).

The vulnerability allows authenticated users to achieve remote code execution on the underlying operating system, potentially leading to complete system compromise. An attacker with Control Panel access could execute arbitrary commands on the server (GitHub POC).

The vulnerability has been patched in ExpressionEngine version 7.2.6. Users running affected versions should upgrade immediately to the latest version to mitigate this security risk (MITRE CVE).