PT-2026-2382 · E107 Cms · E107 Cms

Hubert Wojciechowski · Published 2026-01-13 · Updated 2026-01-15 · CVE-2022-50906

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description An authenticated administrator can bypass upload restrictions in e107 CMS. This allows the upload of malicious SVG files through the media manager. Successful exploitation enables attackers to upload SVG files containing cross-site scripting (XSS) payloads. When viewed, these payloads can execute arbitrary scripts. The vulnerable functionality is related to file uploads via the media manager.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-50906

Affected Products

E107 Cms

References · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50906 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50906 · Security Note
• https://vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-stored-xss · Note
• https://e107.org · Note
• https://e107.org/download · Note
• https://twitter.com/CVEnew/status/2011759625498976575 · Twitter Post