PT-2026-2392 · E107 Cms · E107 Cms

Hubert Wojciechowski · CVE-2022-50916 · Published 2026-01-13 · Updated 2026-01-15

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description The application contains a file upload issue that allows administrators with authentication to overwrite server files using the Media Manager import functionality. Specifically, attackers can manipulate the upload URL parameter to overwrite files such as top.php within the web application directory.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Media Manager import functionality.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-50916

Affected Products

E107 Cms

References · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50916 · Security Note
• https://e107.org/download · Note
• https://twitter.com/CVEnew/status/2011759615864717513 · Twitter Post
• https://e107.org · Note
• https://vulncheck.com/advisories/e-cms-upload-restriction-bypass-authenticated-admin-server-file-override · Note