PT-2026-2388 · Unknown · Impresscms

Published 2026-01-13 · Updated 2026-01-15 · CVE-2022-50912

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.4.4

Description The software contains a file upload issue due to insufficient extension validation. This allows attackers to upload potentially malicious files by bypassing file upload restrictions using alternative file extensions such as .php2, .php6, .php7, .phps, and .pht. Successful exploitation could lead to the execution of arbitrary PHP code on the server.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-50912

Affected Products

Impresscms

References · 7

• 🔥 https://exploit-db.com/exploits/50890 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-50912 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50912 · Vendor Advisory
• https://github.com/ImpressCMS/impresscms · Note
• https://impresscms.org · Note
• https://twitter.com/CVEnew/status/2011759619715068408 · Twitter Post
• https://vulncheck.com/advisories/impresscms-unrestricted-file-upload · Note