VULNERABILITY INTELLIGENCE

CVE-2022-50912

CVSS score9.8 CRITICAL

EPSS probability1.22%

CISA KEVNot currently listed

Published2026-01-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.

Weakness classification

disclosure@vulncheck.com: CWE-434

Primary references

disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
disclosure@vulncheck.com — Product
disclosure@vulncheck.com — Third Party Advisory