CVE-2023-53959

FileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dll

8.5 High

FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the application launches.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.85%Up 0.7 points since Dec 20, 2025

What each source reports

CVE List Score used 8.5

FileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dll

Record: CVE-2023-53959
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-427
Updated: 2026-11-02

EUVDEUVD-2025-204606 8.5

Record: EUVD-2025-204606
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4h23-hj4v-f4xg 8.5

FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute...

Record: GHSA-4h23-hj4v-f4xg
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-427
Updated: 2026-11-02

NVD 8.5

Record: CVE-2023-53959
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-427
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-53959 8.5

Record: UBUNTU-CVE-2023-53959
CVSS 4.0: 8.5 HighCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

filezilla-project filezilla client

Affected packages

Affected packages
Package	Affected	Fixed
`filezilla` Ubuntu:16.04:LTS	All versions, plus listed versions 3.12.0.2-1ubuntu23.14.1-1ubuntu13.15.0.2-0ubuntu13.15.0.2-1ubuntu1	None known
`filezilla` Ubuntu:18.04:LTS	All versions, plus listed versions 3.27.0~rc1-13.28.0-1	None known
`filezilla` Ubuntu:20.04:LTS	All versions, plus listed versions 3.39.0-23.45.1-33.45.1-3build13.46.3-1~build13.46.3-13.46.3-1build13.46.3-1ubuntu0.1	None known
`filezilla` Ubuntu:22.04:LTS	All versions, plus listed versions 3.52.2-33.56.0-13.56.2-13.57.0-13.57.0-1build13.58.0-13.58.0-1ubuntu0.1	None known
`filezilla` Ubuntu:24.04:LTS	All versions, plus listed versions 3.65.0-33.66.1-23.66.1-33.66.1-3.23.66.1-4 Show 5 moreShow less 3.66.4-13.66.4-23.66.5-23.66.5-2build13.66.5-2build2	None known
`filezilla` Ubuntu:25.10	All versions, plus listed versions 3.68.1-13.69.3-1	None known
`filezilla` Ubuntu:26.10	All versions, plus listed versions 3.69.6-13.69.6-23.70.6-23.71.0-1	None known
`filezilla` Ubuntu:26.04:LTS	All versions, plus listed versions 3.69.3-13.69.5-13.69.6-1	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-53959 is a high vulnerability (CVSS 8.5) in Filezilla-project Filezilla Client, published December 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. No source names a fixed version.