CVE-2022-50939 e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
Authenticated administrators can overwrite arbitrary server files via path traversal in the Media Manager, leading to complete system compromise.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-50939?
CVE-2022-50939 is a high-severity path traversal vulnerability in E107 E107, published on 13 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.
Which versions are affected by CVE-2022-50939?
It affects 1 product.
Products include E107 E107.
How do I fix CVE-2022-50939?
No fix has been published for CVE-2022-50939 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-50939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-50939 exists.
Other vulnerabilities in E107 E107
- CVE-2021-27885 Cross-site request forgery in n/a
- CVE-2016-10753 Deserialization in n/a
- CVE-2018-15901 Cross-site request forgery in n/a
- CVE-2022-50916 e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
- CVE-2022-50907 e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
Sources
Also known as GHSA-wj49-35g3-hmvr.