PT-2026-2415 · E107 Cms · E107 Cms

Hubert Wojciechowski · CVE-2022-50939 · Published 2026-01-13 · Updated 2026-01-14

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description e107 CMS version 3.2.1 has a file upload issue. Authenticated administrators can overwrite server files using path traversal. The issue is located in the Media Manager’s remote URL upload functionality, specifically in the image.php component. The upload caption parameter is not properly sanitized, allowing attackers to use directory traversal sequences (../../../) to overwrite system files outside the intended upload directory. This could lead to a complete compromise of the web application by overwriting configuration files or executable scripts.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict administrative privileges to trusted personnel only.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

CVE-2022-50939

Affected Products

E107 Cms

References · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50939 · Security Note
• https://twitter.com/CVEnew/status/2011383047665471877 · Twitter Post
• https://e107.org · Note
• https://vulncheck.com/advisories/e-cms-upload-restriction-bypass-with-path-traversal-file-override · Note
• https://e107.org/download · Note