PT-2026-2383 · E107 Cms · E107 Cms

Hubert Wojciechowski · Publicado 2026-01-13 · Atualizado 2026-01-15 · CVE-2022-50907

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description e107 CMS version 3.2.1 has a file upload issue. Authenticated administrative users can bypass upload restrictions and execute PHP files. An attacker can upload malicious PHP files to parent directories by manipulating the upload URL parameter. This allows for remote code execution through the Media Manager import feature. The vulnerable parameter is the upload URL parameter.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2022-50907

Produtos afetados

E107 Cms

Referências · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://twitter.com/CVEnew/status/2011759624584614018 · Publicação no Twitter
• https://e107.org/download · Nota
• https://e107.org · Nota
• https://vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-rce · Nota
• https://osv.dev/vulnerability/CVE-2022-50907 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-50907 · Nota de Segurança