CVE-2022-50907 e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
Authenticated administrators can bypass upload restrictions to execute arbitrary PHP code via the Media Manager import feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50907?
CVE-2022-50907 is a high-severity vulnerability in E107 E107, published on 13 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.
Weakness: CWE-434
Which versions are affected by CVE-2022-50907?
It affects 1 product.
Products include E107 E107.
How do I fix CVE-2022-50907?
No fix has been published for CVE-2022-50907 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-50907 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-50907 exists.
Other vulnerabilities in E107 E107
- CVE-2021-27885 Cross-site request forgery in n/a
- CVE-2016-10753 Deserialization in n/a
- CVE-2018-15901 Cross-site request forgery in n/a
- CVE-2022-50916 e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
- CVE-2022-50939 e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
Sources
Also known as GHSA-x4hc-6gqq-2chh.