CVE-2022-50912 ImpressCMS 1.4.4 - Unrestricted File Upload
Attackers can upload malicious files with alternative PHP extensions to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50912?
CVE-2022-50912 is a critical vulnerability in ImpressCMS, published on 13 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload potentially malicious files. Attackers can bypass file upload restrictions by using alternative file extensions .php2.php6.php7.phps.pht to execute arbitrary PHP code on the server.
Weakness: CWE-434
Which versions are affected by CVE-2022-50912?
It affects 1 product.
Products include Impresscms Impresscms.
How do I fix CVE-2022-50912?
No fix has been published for CVE-2022-50912 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-50912 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-50912 exists.
Other vulnerabilities in ImpressCMS
- CVE-2008-3453 Multiple unspecified vulnerabilities in ImpressCMS 1.0 have unknown impact and attack vectors, related to modules/admin.php and "a few files
- CVE-2021-26599 SQL Injection in ImpressCMS
- CVE-2021-26600 Type Confusion in ImpressCMS
- CVE-2022-24977 Path Traversal in ImpressCMS
- CVE-2021-26601 Path Traversal in ImpressCMS
Sources
Also known as GHSA-9h6r-9xvw-j888.