CVE-2022-50907
HighSummary
CVE-2022-50907 affects e107 CMS version 3.2.1. The vulnerability allows authenticated administrative users to bypass upload restrictions and execute PHP files by manipulating the upload URL parameter in the Media Manager import feature. This enables remote code execution on the server.
Risk Assessment
The risk to the organization is critical because an attacker with administrative privileges can take over the server, execute arbitrary code, and then access data, modify content, or pivot to other systems in the infrastructure.
Recommendation
Immediately upgrade e107 CMS to the latest patched version. Additionally, restrict administrator privileges and implement log monitoring and file integrity checks to detect potential abuse.
Other vulnerabilities in e107 CMS
See all- CVE-2022-50939High
Critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to overwrite arbitrary server files via path traversal in the Media Manager's remote URL upload functionality (image.php). The upload_caption parameter is not properly sanitized, enabling directory traversal sequences like ../../../ to overwrite files outside the intended directory. This can lead to complete compromise of the web application.
- CVE-2022-50916High
CVE-2022-50916 affects e107 CMS version 3.2.1. The vulnerability is a file upload flaw in the Media Manager import functionality that allows authenticated administrators to overwrite server files, such as top.php in the web application directory.
- CVE-2022-50905Critical
e107 CMS version 3.2.1 contains multiple vulnerabilities allowing XSS attacks. The first is a reflected XSS in the news comment functionality, where an authenticated user can inject malicious JavaScript via a URL parameter. The second is an upload restriction bypass for admins, allowing SVG files with malicious code to be uploaded via the media manager's remote URL feature, leading to stored XSS.
- CVE-2026-48997High
e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.
- CVE-2026-46620Medium
CSRF vulnerability in e107 CMS before version 2.3.5. The CSRF token validation is skipped if no token is present in the request.
- CVE-2021-47937High
e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.
Original NVD description (English source)
e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature.