CVE-2022-50939
HighSummary
Critical vulnerability in e107 CMS version 3.2.1 allows authenticated administrators to overwrite arbitrary server files via path traversal in the Media Manager's remote URL upload functionality (image.php). The upload_caption parameter is not properly sanitized, enabling directory traversal sequences like ../../../ to overwrite files outside the intended directory. This can lead to complete compromise of the web application.
Risk Assessment
The risk to the organization is critical because an attacker with administrative privileges can overwrite configuration files, executable scripts, or other critical system components, leading to full compromise of the application and potentially the entire server.
Recommendation
Immediately update e107 CMS to the latest version that includes a fix for this vulnerability. Additionally, restrict administrator privileges and monitor logs for unusual file operations.
Other vulnerabilities in e107 CMS
See all- CVE-2022-50916High
CVE-2022-50916 affects e107 CMS version 3.2.1. The vulnerability is a file upload flaw in the Media Manager import functionality that allows authenticated administrators to overwrite server files, such as top.php in the web application directory.
- CVE-2022-50907High
CVE-2022-50907 affects e107 CMS version 3.2.1. The vulnerability allows authenticated administrative users to bypass upload restrictions and execute PHP files by manipulating the upload URL parameter in the Media Manager import feature. This enables remote code execution on the server.
- CVE-2022-50905Critical
e107 CMS version 3.2.1 contains multiple vulnerabilities allowing XSS attacks. The first is a reflected XSS in the news comment functionality, where an authenticated user can inject malicious JavaScript via a URL parameter. The second is an upload restriction bypass for admins, allowing SVG files with malicious code to be uploaded via the media manager's remote URL feature, leading to stored XSS.
- CVE-2026-48997High
e107 is a content management system (CMS), versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In the resize_image() function, the source path is properly escaped, but the destination path is inserted inside raw double quotes, allowing an attacker to inject malicious code.
- CVE-2026-46620Medium
CSRF vulnerability in e107 CMS before version 2.3.5. The CSRF token validation is skipped if no token is present in the request.
- CVE-2021-47937High
e107 CMS 2.3.0 allows authenticated users with theme installation permissions to execute arbitrary code by uploading a malicious theme file. Attackers can upload a crafted theme package via the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.
Original NVD description (English source)
e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is not properly sanitized. An attacker with administrative privileges can use directory traversal sequences (../../../) in the upload_caption field to overwrite critical system files outside the intended upload directory. This can lead to complete compromise of the web application by overwriting configuration files, executable scripts, or other critical system components. The vulnerability was discovered by Hubert Wojciechowski and affects the image.php component in the admin interface.