PT-2026-2415 · E107 Cms · E107 Cms

Hubert Wojciechowski · Publicado 2026-01-13 · Atualizado 2026-01-14 · CVE-2022-50939

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description e107 CMS version 3.2.1 has a file upload issue. Authenticated administrators can overwrite server files using path traversal. The issue is located in the Media Manager’s remote URL upload functionality, specifically in the image.php component. The upload caption parameter is not properly sanitized, allowing attackers to use directory traversal sequences (../../../) to overwrite system files outside the intended upload directory. This could lead to a complete compromise of the web application by overwriting configuration files or executable scripts.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict administrative privileges to trusted personnel only.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

CVE-2022-50939

Produtos afetados

E107 Cms

Referências · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://twitter.com/CVEnew/status/2011383047665471877 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2022-50939 · Aviso do Fabricante
• https://e107.org · Nota
• https://vulncheck.com/advisories/e-cms-upload-restriction-bypass-with-path-traversal-file-override · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-50939 · Nota de Segurança
• https://e107.org/download · Nota