VULNERABILITY INTELLIGENCE
CVE-2022-50907
CVSS score7.2 HIGH
EPSS probability1.25%
CISA KEVNot currently listed
Published2026-01-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
Weakness classification
- disclosure@vulncheck.com: CWE-434
Primary references
- disclosure@vulncheck.com — Product
- disclosure@vulncheck.com — Product
- disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
- disclosure@vulncheck.com — Third Party Advisory