CVE-2022-50907
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
- State
- Published
- Severity
- 8.6 High
- Published
- Jan 13, 2026
- Updated
- Apr 7, 2026
- Reserved
- Jan 11, 2026
Description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
e107 CMSe107 |
|
References
- ExploitDB-50910exploit
- Official e107 CMS Vendor Homepageproduct
- e107 CMS Download Pageproduct
- VulnCheck Advisory: e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCEthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.